Microsoft-Windows-SMBClient

Event	Title	Channel	Sample	Rule
101	Create SrvCall Error: ErrorCode Location: Location Context: Context.	HelperClassDiagnostic	Y	N
201	Session Setup Error: ErrorCode Location: Location Context: Context.	HelperClassDiagnostic	Y	N
301	Tree Connect Error: ErrorCode Location: Location Context: Context.	HelperClassDiagnostic	Y	N
401	Create VNetRoot Error: ErrorCode Location: Location Context: Context.	HelperClassDiagnostic	Y	N
501	Create File Error: ErrorCode Location: Location Context: Context.	HelperClassDiagnostic	Y	N
2000	Packet Fragment (FragmentSize bytes).	Diagnostic	Y	N
20001	Transitioned to State: CurrentOrNextState Context: Context.	HelperClassDiagnostic	Y	N
30101	SMB ISC request: SessionEntry {SessionEntry} ServerName {ServerName}.	XPerfAnalytic	N	N
30102	SMB ISC completion: SessionEntry {SessionEntry} ServerName {ServerName} Status …	XPerfAnalytic	N	N
30103	SMB exchange suspended: RxContext RxContext Exchange Exchange ListHead ListHead.	Analytic	Y	N
30104	SMB exchange resumed: RxContext RxContext Exchange Exchange ExchangeState …	Analytic	Y	N
30105	SMB buffer context suspended: BufferCtxt BufferCtxt Exchange Exchange MidCharge …	Analytic	N	N
30106	SMB buffer context resumed: BufferCtxt BufferCtxt Exchange Exchange MidCharge …	Analytic	N	N
30107	SMB exchange expired: Exchange {Exchange} Window {Window}.	XPerfAnalytic	N	N
30108	SMB Mid window blocked: Window Window HungSession HungSession.	Analytic	N	N
30109	SMB rechunk multi-credit request: BufferCtxt BufferCtxt Exchange Exchange …	Analytic	N	N
30110	SMB initialize Mid window: Server ServerName Window MidWindow.	Analytic	Y	N
30111	SMB Mid window state: Window MidWindow CurrentWindowSize CurrentWindowSize …	Analytic	Y	N
30112	SMB teardown Mid window: Server ServerName Window MidWindow.	Analytic	Y	N
30113	SMB copy data completion: Status Status VcEndpoint VcEndpoint.	Analytic	N	N
30114	SMB send completion: Status Status VcEndpoint VcEndpoint.	Analytic	Y	N
30201	WSK get address info request: ServerName {ServerName} Irp {Irp}.	XPerfAnalytic	N	N
30202	WSK get address info completion: Irp {Irp} Status {Status}.	XPerfAnalytic	N	N
30203	WSK connect: SocketAddress RemoteAddress VcEndpoint VcEndpoint Socket Socket.	Analytic	Y	N
30204	WSK connect completion: VcEndpoint VcEndpoint Socket Socket Status Status.	Analytic	Y	N
30205	WSK send: VcEndpoint VcEndpoint Socket Socket SendMdl SendMdl SendLength …	Analytic	Y	N
30206	WSK send completion: VcEndpoint VcEndpoint Socket Socket SendMdl SendMdl …	Analytic	Y	N
30207	WSK receive: VcEndpoint VcEndpoint Socket Socket ReceiveMdl SendMdl …	Analytic	N	N
30208	WSK receive completion: VcEndpoint VcEndpoint Socket Socket ReceiveMdl SendMdl …	Analytic	N	N
30209	Compression requested for file object Smb2Fobx: Status Status.	Analytic	N	N
30210	Decompression failed: VcEndpoint VcEndpoint Socket Socket ReceiveBuffer SendMdl …	Analytic	N	N
30211	Compression failed: VcEndpoint VcEndpoint Socket Socket SendBuffer SendMdl …	Analytic	N	N
30401	SMB session expired: SessionEntry SessionEntry ServerName ServerName.	Analytic	N	N
30402	SMB 3 part SPN reauth: SessionEntry SessionEntry ServiceName ServerName.	Analytic	N	N
30403	SMB reconnect durable open: Fcb Fcb SrvOpen SrvOpen.	Analytic	N	N
30404	SMB defer open: Fcb Fcb SrvOpen SrvOpen.	Analytic	N	N
30405	SMB undefer open: Fcb Fcb SrvOpen SrvOpen.	Analytic	N	N
30406	SMB send[Count]: [Command] (Mid/Sid/Tid) (MessageId/SessionId/TreeId) MidCharge …	Analytic	Y	N
30407	SMB receive: [Command] (Mid/Sid/Tid) (MessageId/SessionId/TreeId) Creds …	Analytic	Y	N
30408	SMB receive interim: [Command] (Mid/AsyncId/Sid/Tid) …	Analytic	N	N
30409	SMB receive async: [Command] (AsyncId/Sid/Tid) (AsyncId/SessionId/TreeId) Creds …	Analytic	N	N
30410	SMB registry key: RegName = RegValue.	Analytic	Y	N
30501	SMB update file info cache: RxContext RxContext Fcb Fcb FileName FileName.	Analytic	N	N
30502	SMB fetch file info cache: RxContext RxContext Fcb Fcb FileName FileName Status …	Analytic	N	N
30503	SMB invalidate file info cache: RxContext RxContext Fcb Fcb FileName FileName.	Analytic	N	N
30504	SMB update file not found cache: RxContext RxContext Fcb Fcb FileName FileName.	Analytic	N	N
30505	SMB fetch file not found cache: RxContext RxContext Fcb Fcb FileName FileName …	Analytic	N	N
30506	SMB invalidate file not found cache: RxContext RxContext Fcb Fcb FileName …	Analytic	N	N
30507	SMB populate dir cache: RxContext RxContext Fcb Fcb DirName FileName.	Analytic	N	N
30508	SMB fetch dir cache: RxContext RxContext Fcb Fcb FileName FileName Status …	Analytic	N	N
30600	Session Object to ObjectName transitioned from [OldState] to [NewState] with …	ObjectStateDiagnostic	Y	N
30601	Share connection Object to ObjectName transitioned from [OldState] to [NewState] …	ObjectStateDiagnostic	Y	N
30603	Open handle Object to ShareNameObjectName transitioned from [OldState] to …	ObjectStateDiagnostic	N	N
30604	The local computer didn't received an SMB1 negotiate response in the last 20 …	ObjectStateDiagnostic	N	N
30611	Failed to reconnect a persistent handle.	Operational	N	N
30612	Failed to reconnect a resilient handle.	Operational	N	N
30613	Failed to open a persistent handle.	Operational	N	N
30614	Persistent handle {PersistentFID}:{VolatileFID} CreateGUID {CreateGUID} to …	Operational	N	N
30615	Resilient handle {PersistentFID}:{VolatileFID} to {Object}0{Object}2 was …	Operational	N	N
30620	Connection to server {ServerName} IP Address {RemoteAddress} was aborted.	Operational	N	N
30621	Session to server {ObjectName} was lost Status {Status}.	Operational	N	N
30622	Session to server {ObjectName} was re-established.	Operational	N	N
30623	Connection to share {ObjectName} was lost.	Operational	N	N
30624	Connection to share {ObjectName} was re-established.	Operational	N	N
30625	Handle {PersistentFID}:{VolatileFID} CreateGUID {CreateGUID} to …	Operational	N	N
30626	The SMB client received a request to move file server cluster {ServerName} to IP …	Operational	N	N
30627	The SMB client successfully moved file server cluster {ServerName} to IP address …	Operational	N	N
30628	The SMB client failed to move file server cluster {ServerName}.	Operational	N	N
30700	The server {ServerName} does not support multichannel.	Operational	N	N
30701	An invalid FSCTL_QUERY_NETWORK_INTERFACE_INFO response was sent by the server …	ObjectStateDiagnostic	N	N
30702	The client failed to connect to the server ServerName from the local IP address …	ObjectStateDiagnostic	N	N
30703	The client failed to connect to the server ServerName from the local IP address …	ObjectStateDiagnostic	N	N
30704	The client connected to the server ServerName from the local IP address …	ObjectStateDiagnostic	N	N
30705	The client connected to the server ServerName from the local IP address …	ObjectStateDiagnostic	N	N
30706	The client can not connect to the server {ServerName} due to a multichannel …	Operational	N	N
30800	The server name cannot be resolved.	Connectivity	Y	N
30801	Reason.	Connectivity	N	N
30802	Reason.	Connectivity	N	N
30803	Failed to establish a network connection.	Connectivity	Y	Y
30804	A network connection was disconnected.	Connectivity	Y	Y
30805	The client lost its session to the server.	Connectivity	Y	N
30806	The client re-established its session to the server.	Connectivity	Y	Y
30807	The connection to the share was lost.	Connectivity	Y	N
30808	The connection to the share was re-established.	Connectivity	Y	N
30809	A request timed out because there was no response from the server.	Connectivity	N	N
30810	Added a TCP/IP transport interface.	Connectivity	Y	N
30811	Deleted a TCP/IP transport interface.	Connectivity	Y	N
30812	Added a TDI transport interface.	Connectivity	Y	N
30813	Deleted a TDI transport interface.	Connectivity	Y	N
30814	Witness registration has completed.	Connectivity	N	N
30815	Witness deregistration has completed.	Connectivity	N	N
30816	The server failed the negotiate request.	Connectivity	N	N
30817	Close request failed.	Connectivity	N	N
30818	RDMA interfaces are available but the client failed to connect to the server …	Connectivity	N	N
30819	The SMB client received a request to move to a different node on a file server …	Connectivity	N	N
30820	The SMB client successfully moved to a different node on a file server cluster.	Connectivity	N	N
30821	The SMB client failed to move to a different node on a file server cluster.	Connectivity	N	N
30822	Failed to establish an SMB multichannel network connection.	Connectivity	N	N
30823	The connection was terminated due to one or more IO request timeouts.	Connectivity	N	N
30824	The connection was forcibly disconnected.	Connectivity	N	N
30825	The disconnect state on connection was cleared.	Connectivity	N	N
30826	The SMB negotiate response processing failed on the client to determine the …	Connectivity	N	N
30827	Could not find a certificate mapping that matches the server name.	Connectivity	Y	N
30828	The client established its session to the server.	Connectivity	N	N
30829	The client failed to establish its session to the server.	Connectivity	N	N
30830	The SMB redirector selected the connection initiated with the following …	Connectivity	Y	N
30831	The SMB client was denied access to the SMB server during mutual authentication.	Connectivity	N	N
30832	The SMB connection was successfully established.	Connectivity	N	N
30833	The initial connection to the share was established.	Connectivity	Y	N
30834	The client was unable to perform revocation checks on the server certificate …	Connectivity	N	N
30835	Server authentication failed.	Connectivity	N	N
30837	The requested transport is disabled.	Connectivity	N	N
30900	The handle was created without persistence.	Operational	N	N
30904	The server does not support multichannel.	Operational	N	N
30905	The client cannot connect to the server due to a multichannel constraint …	Operational	N	N
30906	A request on persistent/resilient handle failed because the handle was invalid …	Operational	N	N
30907	The SMB Multichannel registry value is not configured with default settings.	Operational	N	N
30908	The SMB 3 and SMB 2 driver is not configured with the default start type.	Operational	N	N
30909	The client supports SMB Direct (RDMA) and SMB Signing is in use.	Operational	N	N
30910	The client supports SMB Direct (RDMA) and SMB Encryption is in use.	Operational	N	N
30911	The Cipher Suite Order group policy setting is invalid.	Operational	N	N
30912	The RequireSecureNegotiate setting has been removed.	Operational	N	N
30913	Server ServerName share ShareName has requested client to use isolated …	Operational	N	N
30914	RDMA rundown is active.	Operational	N	N
30915	RDMA rundown is complete.	Operational	N	N
30916	Reactivation of RDMA support has commenced.	Operational	N	N
30917	RDMA is no longer disabled.	Operational	N	N
30918	SMBDirect load attempt complete.	Operational	N	N
30950	Component capabilities: ComponentCapabilities.	Operational	Y	N
30951	The alternative port PortNumber is not a valid port within the range 0 to 65535 …	Operational	N	N
30952	The SMB redirector did not select the connection initiated with the following …	Operational	N	N
30953	SMB Dialect Change.	Operational	N	N
30954	It took CallDuration secs to execute FunctionName.	HelperClassDiagnostic	N	N
30955	It took CallDuration secs to execute FunctionName which is longer than threshold …	Operational	N	N
31000	Reason.	Security	N	N
31001	Reason.	Security	Y	N
31002	The outbound authentication failed using a network token.	Security	Y	N
31003	The LmCompatibilityLevel value is different from the default.	Security	Y	N
31010	The SMB client failed to connect to the share.	Security	Y	N
31012	The negotiate validation failed.	Security	N	N
31013	The signing validation failed.	Security	N	N
31014	The client received an unencrypted message when encryption was expected.	Security	N	N
31015	Failed to decrypt an encrypted SMB message.	Security	N	N
31016	The SMB Signing registry value is not configured with default settings.	Security	N	N
31017	Rejected an insecure guest logon.	Security	Y	Y
31018	Guidance: An administrator has enabled AllowInsecureGuestAuth.	Security	N	Y
31019	Mutual authentication was unexpectedly lost after re-authenticating to …	Security	N	N
31020	Session key for connection is weaker than required.	Security	N	N
31021	SMB DDP security changed from OldValue to NewValue.	Security	N	N
31022	Allowed an insecure guest logon.	Security	N	N
31023	NTLM is prohibited for authentication on the server.	Security	N	N
31997	The SMB client was logged on as Guest account.	Audit	N	N
31998	The SMB client observed that the server doesn't support signing.	Audit	N	N
31999	The SMB client observed that the server doesn't support encryption.	Audit	N	N
32000	SMB1 negotiate response received from remote device when SMB1 cannot be …	Audit	N	N
32002	The local computer received an SMB1 negotiate response.	Audit	N	N
32003	The local computer didn't received an SMB1 negotiate response in the last Days …	Audit	N	N
32004	SMB2 rxcontext performance work started	Analytic	Y	N
32005	SMB2 exchange performance work started	Analytic	N	N
32006	SMB2 buffer context performance work started	Analytic	N	N
32007	SMB2 performance work transition	Analytic	Y	N
32008	SMB2 rxcontext performance work read summary	Analytic	N	N
32009	SMB2 rxcontext performance work write summary	Analytic	N	N
32010	SMB2 rxcontext performance work create summary	Analytic	N	N
32011	SMB2 rxcontext performance work close summary	Analytic	N	N
32012	SMB2 rxcontext performance work query directory summary	Analytic	N	N
32013	SMB2 rxcontext performance work fsctl summary	Analytic	N	N
32028	SMB2 exchange performance work read summary	Analytic	N	N
32029	SMB2 exchange performance work write summary	Analytic	N	N
32030	SMB2 exchange performance work create summary	Analytic	N	N
32031	SMB2 exchange performance work close summary	Analytic	N	N
32032	SMB2 exchange performance work query directory summary	Analytic	N	N
32033	SMB2 exchange performance work fsctl summary	Analytic	N	N
32048	SMB2 buffer context performance work read summary	Analytic	N	N
32049	SMB2 buffer context performance work write summary	Analytic	N	N
32050	SMB2 buffer context performance work create summary	Analytic	N	N
32051	SMB2 buffer context performance work close summary	Analytic	N	N
32052	SMB2 buffer context performance work query directory summary	Analytic	N	N
32053	SMB2 buffer context performance work fsctl summary	Analytic	N	N
32068	SMB2 FCB capture summary	Analytic	Y	N
40000	Packet (PacketSize bytes).	Diagnostic	Y	N

Event ID 101: Create SrvCall Error: ErrorCode Location: Location Context: Context.

Channel: HelperClassDiagnostic
Level: Error
Task: CreateSrvCallError
Opcode: Info

Message #

Create SrvCall Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 101,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 4408
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:16.675Z",
    "version": 0
  },
  "event_data": {
    "Context": 0,
    "ErrorCode": 3221225996,
    "Location": 806355459
  },
  "message": ""
}

Event ID 201: Session Setup Error: ErrorCode Location: Location Context: Context.

Channel: HelperClassDiagnostic
Level: Error
Task: SessionSetupError
Opcode: Info

Message #

Session Setup Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 201,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12604
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.563Z",
    "version": 0
  },
  "event_data": {
    "Context": 13,
    "ErrorCode": 0,
    "Location": 537920984
  },
  "message": ""
}

Event ID 301: Tree Connect Error: ErrorCode Location: Location Context: Context.

Channel: HelperClassDiagnostic
Level: Error
Task: TreeConnectError
Opcode: Info

Message #

Tree Connect Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 301,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.578Z",
    "version": 0
  },
  "event_data": {
    "Context": 11,
    "ErrorCode": 3221225506,
    "Location": 540017009
  },
  "message": ""
}

Event ID 401: Create VNetRoot Error: ErrorCode Location: Location Context: Context.

Channel: HelperClassDiagnostic
Level: Error
Task: CreateVNetRootError
Opcode: Info

Message #

Create VNetRoot Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 401,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12604
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.578Z",
    "version": 0
  },
  "event_data": {
    "Context": 0,
    "ErrorCode": 3221225506,
    "Location": 808452597
  },
  "message": ""
}

Event ID 501: Create File Error: ErrorCode Location: Location Context: Context.

Channel: HelperClassDiagnostic
Level: Error
Task: CreateFileError
Opcode: Info

Message #

Create File Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 501,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12728,
      "thread_id": 8756
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.633Z",
    "version": 0
  },
  "event_data": {
    "Context": 0,
    "ErrorCode": 3221225985,
    "Location": 541065751
  },
  "message": ""
}

Event ID 2000: Packet Fragment (FragmentSize bytes).

Channel: Diagnostic
Level: Informational
Task: PacketFragment
Opcode: Info

Message #

Packet Fragment (%2 bytes)

Fields #

Name	Description
`ReassembledEventID` UInt16
`FragmentSize` UInt32
`FragmentData` Binary

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SmbClient/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11368,
      "thread_id": 11740
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.570Z",
    "version": 0
  },
  "event_data": {
    "FragmentData": "010000001C000000020001BD0A020A0B0000000000000000000000000000000000000000A0000000",
    "FragmentSize": 40,
    "ReassembledEventID": 40000
  },
  "message": ""
}

Event ID 20001: Transitioned to State: CurrentOrNextState Context: Context.

Channel: HelperClassDiagnostic
Level: Informational
Task: CreateFile
Opcode: Info

Message #

Transitioned to State: %1 Context: %2

Fields #

Name	Description
`CurrentOrNextState` UInt8
`Context` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/HelperClassDiagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 20001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11368,
      "thread_id": 11740
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.570Z",
    "version": 0
  },
  "event_data": {
    "Context": 0,
    "CurrentOrNextState": 180
  },
  "message": ""
}

Event ID 30101: SMB ISC request: SessionEntry {SessionEntry} ServerName {ServerName}.

Channel: XPerfAnalytic

Fields #

Name	Description
`SessionEntry`
`ServerName`

Event ID 30102: SMB ISC completion: SessionEntry {SessionEntry} ServerName {ServerName} Status {Status}.

Channel: XPerfAnalytic

Fields #

Name	Description
`SessionEntry`
`ServerName`
`Status`	NTSTATUS reference

Event ID 30103: SMB exchange suspended: RxContext RxContext Exchange Exchange ListHead ListHead.

Channel: Analytic
Level: Verbose
Task: SmbSuspendExchange
Opcode: Info

Message #

SMB exchange suspended: RxContext %1 Exchange %2 ListHead %3

Fields #

Name	Description
`RxContext` Pointer
`Exchange` Pointer
`ListHead` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30103,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11368,
      "thread_id": 11740
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.561Z",
    "version": 0
  },
  "event_data": {
    "Exchange": "0xFFFFC807B609FE00",
    "ListHead": "0xFFFFC807C832DE48",
    "RxContext": "0xFFFFC807BA673990"
  },
  "message": ""
}

Event ID 30104: SMB exchange resumed: RxContext RxContext Exchange Exchange ExchangeState ExchangeState ExchangeStatus ExchangeStatus.

Channel: Analytic
Level: Verbose
Task: SmbResumeExchange
Opcode: Info

Message #

SMB exchange resumed: RxContext %1 Exchange %2 ExchangeState %3 ExchangeStatus %4

Fields #

Name	Description
`RxContext` Pointer
`Exchange` Pointer
`ExchangeState` UInt32
`ExchangeStatus` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30104,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12604
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.568Z",
    "version": 0
  },
  "event_data": {
    "Exchange": "0xFFFFC807B662E910",
    "ExchangeState": 4,
    "ExchangeStatus": 0,
    "RxContext": "0x0"
  },
  "message": ""
}

Event ID 30105: SMB buffer context suspended: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit CurrentWind...

Channel: Analytic
Task: SmbSuspendBufferCtxt
Opcode: Info

Description

SMB buffer context suspended: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit CurrentWindowSize CurrentWindowSize.

Message #

SMB buffer context suspended: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7

Fields #

Name	Description
`BufferCtxt` Pointer
`Exchange` Pointer
`MidCharge` UInt32
`Window` Pointer
`CurrentWindowLimit` UInt32
`ThrottlingWindowLimit` UInt32
`CurrentWindowSize` UInt32

Event ID 30106: SMB buffer context resumed: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit CurrentWindow...

Channel: Analytic
Task: SmbResumeBufferCtxt
Opcode: Info

Description

SMB buffer context resumed: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit CurrentWindowSize CurrentWindowSize.

Message #

SMB buffer context resumed: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7

Fields #

Name	Description
`BufferCtxt` Pointer
`Exchange` Pointer
`MidCharge` UInt32
`Window` Pointer
`CurrentWindowLimit` UInt32
`ThrottlingWindowLimit` UInt32
`CurrentWindowSize` UInt32

Event ID 30107: SMB exchange expired: Exchange {Exchange} Window {Window}.

Channel: XPerfAnalytic

Fields #

Name	Description
`Exchange`
`Window`

Event ID 30108: SMB Mid window blocked: Window Window HungSession HungSession.

Channel: Analytic
Task: SmbMidWindowBlocked
Opcode: Info

Message #

SMB Mid window blocked: Window %1 HungSession %2

Fields #

Name	Description
`Window` Pointer
`HungSession` UInt32

Event ID 30109: SMB rechunk multi-credit request: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit Current...

Channel: Analytic
Task: SmbRechunkRequest
Opcode: Info

Description

SMB rechunk multi-credit request: BufferCtxt BufferCtxt Exchange Exchange MidCharge MidCharge Window Window CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit CurrentWindowSize CurrentWindowSize.

Message #

SMB rechunk multi-credit request: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7

Fields #

Name	Description
`BufferCtxt` Pointer
`Exchange` Pointer
`MidCharge` UInt32
`Window` Pointer
`CurrentWindowLimit` UInt32
`ThrottlingWindowLimit` UInt32
`CurrentWindowSize` UInt32

Event ID 30110: SMB initialize Mid window: Server ServerName Window MidWindow.

Channel: Analytic
Level: Verbose
Task: SmbInitializeMidWindow
Opcode: Info

Message #

SMB initialize Mid window: Server %2 Window %3

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`MidWindow` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30110,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12604
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.556Z",
    "version": 0
  },
  "event_data": {
    "MidWindow": "0xFFFFC807CA8E79D0",
    "ServerName": "\\10.2.10.11",
    "ServerNameLength": 11
  },
  "message": ""
}

Event ID 30111: SMB Mid window state: Window MidWindow CurrentWindowSize CurrentWindowSize CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit OldestPendingMid OldestPendingMid NextAv...

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: SmbMidWindowState
Opcode: Info

Description

SMB Mid window state: Window MidWindow CurrentWindowSize CurrentWindowSize CurrentWindowLimit CurrentWindowLimit ThrottlingWindowLimit ThrottlingWindowLimit OldestPendingMid OldestPendingMid NextAvailableMid NextAvailableMid CreditsGranted CreditsGranted.

Message #

SMB Mid window state: Window %1 CurrentWindowSize %2 CurrentWindowLimit %3 ThrottlingWindowLimit %4 OldestPendingMid %5 NextAvailableMid %6 CreditsGranted %7

Fields #

Name	Description
`MidWindow` Pointer
`CurrentWindowSize` UInt32
`CurrentWindowLimit` UInt32
`ThrottlingWindowLimit` UInt32
`OldestPendingMid` UInt64
`NextAvailableMid` UInt64
`CreditsGranted` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30111,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000001",
    "time_created": "2026-06-02T06:02:54.813+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CreditsGranted": 0,
    "CurrentWindowLimit": 33,
    "CurrentWindowSize": 1,
    "MidWindow": "0xFFFFBD09ED260610",
    "NextAvailableMid": 7,
    "OldestPendingMid": 6,
    "ThrottlingWindowLimit": 2
  },
  "message": "SmbMidWindowState "
}

Event ID 30112: SMB teardown Mid window: Server ServerName Window MidWindow.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: SmbTeardownMidWindow
Opcode: Info

Message #

SMB teardown Mid window: Server %2 Window %3

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`MidWindow` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30112,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000001",
    "time_created": "2026-06-02T06:02:54.815+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "MidWindow": "0xFFFFBD09ED260610",
    "ServerName": "",
    "ServerNameLength": 0
  },
  "message": "SmbTeardownMidWindow "
}

Event ID 30113: SMB copy data completion: Status Status VcEndpoint VcEndpoint.

Channel: Analytic
Task: SmbDataReady
Opcode: Info

Message #

SMB copy data completion: Status %1 VcEndpoint %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`VcEndpoint` Pointer

Event ID 30114: SMB send completion: Status Status VcEndpoint VcEndpoint.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: SmbSendCompletion
Opcode: Info

Message #

SMB send completion: Status %1 VcEndpoint %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`VcEndpoint` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30114,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000001",
    "time_created": "2026-06-02T06:02:54.814+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 10660,
      "thread_id": 17284
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 0,
    "VcEndpoint": "0xFFFFBD09F3610AE0"
  },
  "message": "SmbSendCompletion "
}

Event ID 30201: WSK get address info request: ServerName {ServerName} Irp {Irp}.

Channel: XPerfAnalytic

Fields #

Name	Description
`ServerName`
`Irp`

Event ID 30202: WSK get address info completion: Irp {Irp} Status {Status}.

Channel: XPerfAnalytic

Fields #

Name	Description
`Irp`
`Status`	NTSTATUS reference

Event ID 30203: WSK connect: SocketAddress RemoteAddress VcEndpoint VcEndpoint Socket Socket.

Channel: Analytic
Level: Informational
Task: NetConnect
Opcode: Info

Message #

WSK connect: SocketAddress %2 VcEndpoint %3 Socket %4

Fields #

Name	Description
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`VcEndpoint` Pointer
`Socket` Pointer
`ConnectionType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30203,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 4408
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:47.555Z",
    "version": 0
  },
  "event_data": {
    "ConnectionType": 1,
    "RemoteAddress": "020001BD0A020A0B0000000000000000",
    "RemoteAddressLength": 16,
    "Socket": "0xFFFFC807BFE83548",
    "VcEndpoint": "0xFFFFC807BB6A5370"
  },
  "message": ""
}

Event ID 30204: WSK connect completion: VcEndpoint VcEndpoint Socket Socket Status Status.

Channel: Analytic
Level: Informational
Task: NetConnectCompletion
Opcode: Info

Message #

WSK connect completion: VcEndpoint %1 Socket %2 Status %3

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`Status` UInt32	NTSTATUS reference
`ConnectionType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-SMBClient/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30204,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SMBClient",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:22:11.020Z",
    "version": 0
  },
  "event_data": {
    "ConnectionType": 1,
    "Socket": "0xFFFFC807BFEA8AE8",
    "Status": 3221225653,
    "VcEndpoint": "0xFFFFC807C2588990"
  },
  "message": ""
}

Event ID 30205: WSK send: VcEndpoint VcEndpoint Socket Socket SendMdl SendMdl SendLength SendLength.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: NetSend
Opcode: Info

Message #

WSK send: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`ConnectionType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30205,
    "version": 2,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000002",
    "time_created": "2026-06-02T06:02:54.813+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "SendLength": 72,
    "SendMdl": "0xFFFFBD09F1C62860",
    "Socket": "0xFFFFBD09F4380208",
    "VcEndpoint": "0xFFFFBD09F3610AE0"
  },
  "message": "NetSend "
}

Event ID 30206: WSK send completion: VcEndpoint VcEndpoint Socket Socket SendMdl SendMdl SendLength SendLength Status Status.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: NetSendCompletion
Opcode: Info

Message #

WSK send completion: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4 Status %5

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`Status` UInt32	NTSTATUS reference
`ConnectionType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30206,
    "version": 2,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000002",
    "time_created": "2026-06-02T06:02:54.814+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 10660,
      "thread_id": 17284
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "SendLength": 68,
    "SendMdl": "0xFFFFBD09F1961DD0",
    "Socket": "0xFFFFBD09F4380208",
    "Status": 0,
    "VcEndpoint": "0xFFFFBD09F3610AE0"
  },
  "message": "NetSendCompletion "
}

Event ID 30207: WSK receive: VcEndpoint VcEndpoint Socket Socket ReceiveMdl SendMdl ReceiveLength SendLength.

Channel: Analytic
Task: NetReceive
Opcode: Info

Message #

WSK receive: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`ConnectionType` UInt32

Event ID 30208: WSK receive completion: VcEndpoint VcEndpoint Socket Socket ReceiveMdl SendMdl ReceiveLength SendLength Status Status.

Channel: Analytic
Task: NetReceiveCompletion
Opcode: Info

Message #

WSK receive completion: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4 Status %5

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`Status` UInt32	NTSTATUS reference
`ConnectionType` UInt32

Event ID 30209: Compression requested for file object Smb2Fobx: Status Status.

Channel: Analytic
Task: CompressionRequested
Opcode: Info

Message #

Compression requested for file object %3: Status %4

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`Smb2Fobx` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 30210: Decompression failed: VcEndpoint VcEndpoint Socket Socket ReceiveBuffer SendMdl ReceiveLength SendLength Status Status.

Channel: Analytic
Task: DecompressionFailure
Opcode: Info

Message #

Decompression failed: VcEndpoint %1 Socket %2 ReceiveBuffer %3 ReceiveLength %4 Status %5

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`Status` UInt32	NTSTATUS reference
`ConnectionType` UInt32

Event ID 30211: Compression failed: VcEndpoint VcEndpoint Socket Socket SendBuffer SendMdl SendLength SendLength Status Status.

Channel: Analytic
Task: CompressionFailure
Opcode: Info

Message #

Compression failed: VcEndpoint %1 Socket %2 SendBuffer %3 SendLength %4 Status %5

Fields #

Name	Description
`VcEndpoint` Pointer
`Socket` Pointer
`SendMdl` Pointer
`SendLength` UInt32
`Status` UInt32	NTSTATUS reference
`ConnectionType` UInt32

Event ID 30401: SMB session expired: SessionEntry SessionEntry ServerName ServerName.

Channel: Analytic
Task: SmbSessionExpired
Opcode: Info

Message #

SMB session expired: SessionEntry %1 ServerName %3

Fields #

Name	Description
`SessionEntry` Pointer
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30402: SMB 3 part SPN reauth: SessionEntry SessionEntry ServiceName ServerName.

Channel: Analytic
Task: Smb3PartSPNReauth
Opcode: Info

Message #

SMB 3 part SPN reauth: SessionEntry %1 ServiceName %3

Fields #

Name	Description
`SessionEntry` Pointer
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30403: SMB reconnect durable open: Fcb Fcb SrvOpen SrvOpen.

Channel: Analytic
Task: SmbReconnect
Opcode: Info

Message #

SMB reconnect durable open: Fcb %1 SrvOpen %2

Fields #

Name	Description
`Fcb` Pointer
`SrvOpen` Pointer

Event ID 30404: SMB defer open: Fcb Fcb SrvOpen SrvOpen.

Channel: Analytic
Task: SmbDeferOpen
Opcode: Info

Message #

SMB defer open: Fcb %1 SrvOpen %2

Fields #

Name	Description
`Fcb` Pointer
`SrvOpen` Pointer

Event ID 30405: SMB undefer open: Fcb Fcb SrvOpen SrvOpen.

Channel: Analytic
Task: SmbUndeferOpen
Opcode: Info

Message #

SMB undefer open: Fcb %1 SrvOpen %2

Fields #

Name	Description
`Fcb` Pointer
`SrvOpen` Pointer

Event ID 30406: SMB send[Count]: [Command] (Mid/Sid/Tid) (MessageId/SessionId/TreeId) MidCharge MidCharge Creds CreditRequested SendLengh SendLength VcEndpoint VcEndpoint.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: SmbSend
Opcode: Info

Message #

SMB send[%1]: [%2] (Mid/Sid/Tid) (%3/%4/%5) MidCharge %6 Creds %7 SendLengh %8 VcEndpoint %9

Fields #

Name	Description
`Count` UInt32
`Command` AnsiString
`MessageId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`MidCharge` UInt16
`CreditRequested` UInt16
`SendLength` UInt32
`VcEndpoint` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30406,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000004",
    "time_created": "2026-06-02T06:02:54.813+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Command": "TRE_DCON",
    "Count": 0,
    "CreditRequested": 1,
    "MessageId": 6,
    "MidCharge": 1,
    "SendLength": 68,
    "SessionId": 105556337492013,
    "TreeId": 1,
    "VcEndpoint": "0xFFFFBD09F3610AE0"
  },
  "message": "SmbSend "
}

Event ID 30407: SMB receive: [Command] (Mid/Sid/Tid) (MessageId/SessionId/TreeId) Creds CreditGranted Status Status VcEndpoint VcEndpoint.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: SmbReceive
Opcode: Info

Message #

SMB receive: [%1] (Mid/Sid/Tid) (%2/%4/%5) Creds %6 Status %7 VcEndpoint %8

Fields #

Name	Description
`Command` AnsiString
`MessageId` UInt64
`AsyncId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`CreditGranted` UInt16
`Status` UInt32	NTSTATUS reference
`VcEndpoint` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30407,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000004",
    "time_created": "2026-06-02T06:02:54.814+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 10660,
      "thread_id": 17284
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AsyncId": 0,
    "Command": "TRE_DCON",
    "CreditGranted": 1,
    "MessageId": 6,
    "SessionId": 3221225517,
    "Status": 0,
    "TreeId": 1,
    "VcEndpoint": "0xFFFFBD09F3610AE0"
  },
  "message": "SmbReceive "
}

Event ID 30408: SMB receive interim: [Command] (Mid/AsyncId/Sid/Tid) (MessageId/AsyncId/SessionId/TreeId) Creds CreditGranted Status Status VcEndpoint VcEndpoint.

Channel: Analytic
Task: SmbReceiveInterim
Opcode: Info

Message #

SMB receive interim: [%1] (Mid/AsyncId/Sid/Tid) (%2/%3/%4/%5) Creds %6 Status %7 VcEndpoint %8

Fields #

Name	Description
`Command` AnsiString
`MessageId` UInt64
`AsyncId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`CreditGranted` UInt16
`Status` UInt32	NTSTATUS reference
`VcEndpoint` Pointer

Event ID 30409: SMB receive async: [Command] (AsyncId/Sid/Tid) (AsyncId/SessionId/TreeId) Creds CreditGranted Status Status VcEndpoint VcEndpoint.

Channel: Analytic
Task: SmbReceiveAsync
Opcode: Info

Message #

SMB receive async: [%1] (AsyncId/Sid/Tid) (%3/%4/%5) Creds %6 Status %7 VcEndpoint %8

Fields #

Name	Description
`Command` AnsiString
`MessageId` UInt64
`AsyncId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`CreditGranted` UInt16
`Status` UInt32	NTSTATUS reference
`VcEndpoint` Pointer

Event ID 30410: SMB registry key: RegName = RegValue.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: SmbRegistryKey
Opcode: Info

Message #

SMB registry key: %1 = %2

Fields #

Name	Description
`RegName` UnicodeString
`RegValue` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30410,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x1000000000000004",
    "time_created": "2026-06-02T05:31:02.286+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 11444,
      "thread_id": 12576
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RegName": "RequireSecuritySignature",
    "RegValue": 0
  },
  "message": ""
}

Event ID 30501: SMB update file info cache: RxContext RxContext Fcb Fcb FileName FileName.

Channel: Analytic
Task: SmbUpdateInfoCache
Opcode: Info

Message #

SMB update file info cache: RxContext %1 Fcb %2 FileName %4

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30502: SMB fetch file info cache: RxContext RxContext Fcb Fcb FileName FileName Status Status.

Channel: Analytic
Task: SmbFetchInfoCache
Opcode: Info

Message #

SMB fetch file info cache: RxContext %1 Fcb %2 FileName %4 Status %5

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30503: SMB invalidate file info cache: RxContext RxContext Fcb Fcb FileName FileName.

Channel: Analytic
Task: SmbInvalidateInfoCache
Opcode: Info

Message #

SMB invalidate file info cache: RxContext %1 Fcb %2 FileName %4

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30504: SMB update file not found cache: RxContext RxContext Fcb Fcb FileName FileName.

Channel: Analytic
Task: SmbUpdateFNFCache
Opcode: Info

Message #

SMB update file not found cache: RxContext %1 Fcb %2 FileName %4

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30505: SMB fetch file not found cache: RxContext RxContext Fcb Fcb FileName FileName Result Status.

Channel: Analytic
Task: SmbFetchFNFCache
Opcode: Info

Message #

SMB fetch file not found cache: RxContext %1 Fcb %2 FileName %4 Result %5

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30506: SMB invalidate file not found cache: RxContext RxContext Fcb Fcb FileName FileName.

Channel: Analytic
Task: SmbInvalidateFNFCache
Opcode: Info

Message #

SMB invalidate file not found cache: RxContext %1 Fcb %2 FileName %4

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30507: SMB populate dir cache: RxContext RxContext Fcb Fcb DirName FileName.

Channel: Analytic
Task: SmbPopulateDirCache
Opcode: Info

Message #

SMB populate dir cache: RxContext %1 Fcb %2 DirName %4

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30508: SMB fetch dir cache: RxContext RxContext Fcb Fcb FileName FileName Status Status.

Channel: Analytic
Task: SmbFetchDirCache
Opcode: Info

Message #

SMB fetch dir cache: RxContext %1 Fcb %2 FileName %4 Status %5

Fields #

Name	Description
`RxContext` Pointer
`Fcb` Pointer
`FileNameLength` UInt16
`FileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30600: Session Object to ObjectName transitioned from [OldState] to [NewState] with Status Status.

Channel: ObjectStateDiagnostic
Also via: realtime ETW trace
Level: Informational
Task: SessionStateTransition
Opcode: Info

Message #

Session %1 to %6 transitioned from [%2] to [%3] with Status %4

Fields #

Name	Description
`Object` Pointer
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`NameLength` UInt16
`ObjectName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30600,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x4000000000000010",
    "time_created": "2026-06-02T06:02:54.814+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NameLength": 26,
    "NewState": 6,
    "Object": "0xFFFFBD09F3149AA0",
    "ObjectName": "\\JD-DC01-2022.ludus.domain",
    "OldState": 0,
    "Status": 3221225996
  },
  "message": "SessionStateTransition "
}

Event ID 30601: Share connection Object to ObjectName transitioned from [OldState] to [NewState] with Status Status.

Channel: ObjectStateDiagnostic
Also via: realtime ETW trace
Level: Informational
Task: VNetRootStateTransition
Opcode: Info

Message #

Share connection %1 to %6 transitioned from [%2] to [%3] with Status %4

Fields #

Name	Description
`Object` Pointer
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`NameLength` UInt16
`ObjectName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30601,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x4000000000000010",
    "time_created": "2026-06-02T06:02:54.813+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NameLength": 31,
    "NewState": 6,
    "Object": "0xFFFFBD09F46F2620",
    "ObjectName": "\\JD-DC01-2022.ludus.domain\\IPC$",
    "OldState": 0,
    "Status": 3221225996
  },
  "message": "VNetRootStateTransition "
}

Event ID 30603: Open handle Object to ShareNameObjectName transitioned from [OldState] to [NewState] with Status Status.

Channel: ObjectStateDiagnostic
Task: OpenHandleStateTransition
Opcode: Info

Message #

Open handle %1 to %10%12 transitioned from [%5] to [%6] with Status %7

Fields #

Name	Description
`Object` Pointer
`PersistentFID` UInt64
`VolatileFID` UInt64
`CreateGUID` GUID
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`PreviousStatus` UInt32
`PreviousReason` UInt32

Event ID 30604: The local computer didn't received an SMB1 negotiate response in the last 20 minutes.

Channel: ObjectStateDiagnostic
Task: NoSMB1ObservedInLastPeriod
Opcode: Info

Description

The local computer didn't received an SMB1 negotiate response in the last 20 minutes.n.

Message #

The local computer didn't received an SMB1 negotiate response in the last 20 minutes.n
Guidance:

This event indicates that no attempt was made to contact this computer via the SMB1 protocol. After %1 online days of no SMB1 contact attempts, the SMB1 Client service will automatically uninstall.

Fields #

Name	Description
`Days` UInt32

Event ID 30611: Failed to reconnect a persistent handle.

Channel: Operational
Task: PersistentHandleFailure
Opcode: Info

Message #

Failed to reconnect a persistent handle.

Error: %7

FileId: %2:%3
CreateGUID: %4
Path: %10%12

Reason: %8

Previous reconnect error: %13
Previous reconnect reason: %14

Guidance:
A persistent handle allows transparent failover on Windows File Server clusters. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.

Fields #

Name	Description
`Object` Pointer
`PersistentFID` UInt64
`VolatileFID` UInt64
`CreateGUID` GUID
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`PreviousStatus` UInt32
`PreviousReason` UInt32

Event ID 30612: Failed to reconnect a resilient handle.

Channel: Operational
Task: ResilientHandleFailure
Opcode: Info

Message #

Failed to reconnect a resilient handle.

Error: %7

FileId: %2:%3
Path: %10%12

Reason: %8.

Previous reconnect error: %13
Previous reconnect reason: %14

Guidance:
A resilient handle provides guarantees to applications requesting it. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.

Fields #

Name	Description
`Object` Pointer
`PersistentFID` UInt64
`VolatileFID` UInt64
`CreateGUID` GUID
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`PreviousStatus` UInt32
`PreviousReason` UInt32

Event ID 30613: Failed to open a persistent handle.

Channel: Operational
Task: HandleOpenFailure
Opcode: Info

Message #

Failed to open a persistent handle.

Error: %7

FileId: %2:%3
CreateGUID: %4
Path: %10%12

Reason: %8

Guidance:
A persistent handle allows transparent failover on Windows File Server clusters. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.

Fields #

Name	Description
`Object` Pointer
`PersistentFID` UInt64
`VolatileFID` UInt64
`CreateGUID` GUID
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`PreviousStatus` UInt32
`PreviousReason` UInt32

Event ID 30614: Persistent handle {PersistentFID}:{VolatileFID} CreateGUID {CreateGUID} to {Object}0{Object}2 was orphaned.

Channel: Operational

Fields #

Name	Description
`PersistentFID`
`VolatileFID`
`CreateGUID`
`Object`

Event ID 30615: Resilient handle {PersistentFID}:{VolatileFID} to {Object}0{Object}2 was orphaned.

Channel: Operational

Fields #

Name	Description
`PersistentFID`
`VolatileFID`
`Object`

Event ID 30620: Connection to server {ServerName} IP Address {RemoteAddress} was aborted.

Channel: Operational

Fields #

Name	Description
`ServerName`
`RemoteAddress`

Event ID 30621: Session to server {ObjectName} was lost Status {Status}.

Channel: Operational

Fields #

Name	Description
`ObjectName`
`Status`	NTSTATUS reference

Event ID 30622: Session to server {ObjectName} was re-established.

Channel: Operational
Collection Priority: Recommended (Microsoft-WEF)

Fields #

Name	Description
`ObjectName`

Event ID 30623: Connection to share {ObjectName} was lost.

Channel: Operational

Description

Connection to share {ObjectName} was lost. Status {Status}.

Message #

Connection to share {ObjectName} was lost. Status {Status}

Fields #

Name	Description
`ObjectName`
`Status`	NTSTATUS reference

Event ID 30624: Connection to share {ObjectName} was re-established.

Channel: Operational
Collection Priority: Recommended (Microsoft-WEF)

Fields #

Name	Description
`ObjectName`

Event ID 30625: Handle {PersistentFID}:{VolatileFID} CreateGUID {CreateGUID} to {Object}0{Object}2 granted without persistence.

Channel: Operational

Fields #

Name	Description
`PersistentFID`
`VolatileFID`
`CreateGUID`
`Object`

Event ID 30626: The SMB client received a request to move file server cluster {ServerName} to IP address {RemoteAddress}.

Channel: Operational

Fields #

Name	Description
`ServerName`
`RemoteAddress`

Event ID 30627: The SMB client successfully moved file server cluster {ServerName} to IP address {RemoteAddress}.

Channel: Operational

Fields #

Name	Description
`ServerName`
`RemoteAddress`

Event ID 30628: The SMB client failed to move file server cluster {ServerName}.

Channel: Operational

Description

The SMB client failed to move file server cluster {ServerName}. Error: {Status}.

Message #

The SMB client failed to move file server cluster {ServerName}. Error: {Status}

Fields #

Name	Description
`ServerName`
`Status`	NTSTATUS reference

Event ID 30700: The server {ServerName} does not support multichannel.

Channel: Operational

Fields #

Name	Description
`ServerName`

Event ID 30701: An invalid FSCTL_QUERY_NETWORK_INTERFACE_INFO response was sent by the server ServerName.

Channel: ObjectStateDiagnostic
Task: ServerNetworkInterfaceInvalid
Opcode: Info

Message #

An invalid FSCTL_QUERY_NETWORK_INTERFACE_INFO response was sent by the server %2

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30702: The client failed to connect to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over TCP transport.

Channel: ObjectStateDiagnostic
Task: WskConnectFailure
Opcode: Info

Description

The client failed to connect to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over TCP transport. Error: Status.

Message #

The client failed to connect to the server %2 from the local IP address %4 to the remote IP address %6 over TCP transport. Error: %7

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`Status` UInt32	NTSTATUS reference

Event ID 30703: The client failed to connect to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over RDMA transport.

Channel: ObjectStateDiagnostic
Task: RdmaConnectFailure
Opcode: Info

Description

The client failed to connect to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over RDMA transport. Error: Status.

Message #

The client failed to connect to the server %2 from the local IP address %4 to the remote IP address %6 over RDMA transport. Error: %7

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`Status` UInt32	NTSTATUS reference

Event ID 30704: The client connected to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over TCP transport successfully.

Channel: ObjectStateDiagnostic
Task: WskConnectSuccess
Opcode: Info

Message #

The client connected to the server %2 from the local IP address %4 to the remote IP address %6 over TCP transport successfully

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`Status` UInt32	NTSTATUS reference

Event ID 30705: The client connected to the server ServerName from the local IP address LocalAddress to the remote IP address RemoteAddress over RDMA transport successfully.

Channel: ObjectStateDiagnostic
Task: RdmaConnectSuccess
Opcode: Info

Message #

The client connected to the server %2 from the local IP address %4 to the remote IP address %6 over RDMA transport successfully

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`Status` UInt32	NTSTATUS reference

Event ID 30706: The client can not connect to the server {ServerName} due to a multichannel constraint registry setting.

Channel: Operational

Fields #

Name	Description
`ServerName`

Event ID 30800: The server name cannot be resolved.

Channel: Connectivity
Level: Error
Task: WskGetAddressInfoFailure
Opcode: Info

Message #

The server name cannot be resolved.

Error: %2

Server name: %4

Guidance:
The client cannot resolve the server address in DNS or WINS. This issue often manifests immediately after joining a computer to the domain, when the client's DNS registration may not yet have propagated to all DNS servers. You should also expect this event at system startup on a DNS server (such as a domain controller) that points to itself for the primary DNS. You should validate the DNS client settings on this computer using IPCONFIG /ALL and NSLOOKUP.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30800,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-05-28T22:42:26.7714555+00:00",
    "event_record_id": 45,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 492
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Reason": "1",
    "Status": "3221226021",
    "ServerNameLength": "19",
    "ServerName": "cell-a.ludus.domain"
  },
  "message": "The server name cannot be resolved.\r\n\r\nError: The object was not found.\r\n\r\nServer name: cell-a.ludus.domain\r\n\r\nGuidance:\r\nThe client cannot resolve the server address in DNS or WINS. This issue often manifests immediately after joining a computer to the domain, when the client's DNS registration may not yet have propagated to all DNS servers. You should also expect this event at system startup on a DNS server (such as a domain controller) that points to itself for the primary DNS. You should validate the DNS client settings on this computer using IPCONFIG /ALL and NSLOOKUP."
}

Event ID 30801: Reason.

Channel: Connectivity
Task: SetSocketSecurityFailure
Opcode: Info

Description

Reason. Error: Status Server name: ServerName

Message #

%1.

Error: %2

Server name: %4

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30802: Reason.

Channel: Connectivity
Task: IPSecFailure
Opcode: Info

Description

Reason. Error: Status Server name: ServerName

Message #

%1.

Error: %2

Server name: %4

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30803: Failed to establish a network connection.

Channel: Connectivity
Level: Error
Task: NetworkConnectFailure
Opcode: Info

Message #

Failed to establish a network connection.

Error: %2

Server name: %4
Server address: %6!S!
Connection type: %7

Guidance:
This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter, can also cause this issue.

Fields #

Name	Description	Rules
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`RemoteAddress` Binary		8 detection rules
`LocalAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`ConnectionType` UInt32
`PortSelectionOrigin` UInt32
`ConnectionIdSize` UInt32
`ConnectionId` Binary
`ClientCertSha1HashSize` UInt32
`ClientCertSha1Hash` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30803,
    "version": 2,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-17T05:21:07.002021+00:00",
    "event_record_id": 35,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 12828
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Reason": 0,
    "Status": 3221226045,
    "ServerNameLength": 25,
    "ServerName": "LAB-DC01.ludus.domain",
    "AddressLength": 16,
    "RemoteAddress": "020001BB0A020A0B0000000000000000",
    "LocalAddress": "00000000000000000000000000000000",
    "InstanceNameLength": 24,
    "InstanceName": "\\Device\\LanmanRedirector",
    "ConnectionType": 4
  },
  "message": ""
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Potential CVE-2023-23397 Exploitation Attempt - SMB source medium: Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.↳ also matches Event ID 30804: A network connection was disconnected., Event ID 30806: The client re-established its session to the server.

Event ID 30804: A network connection was disconnected.

Channel: Connectivity
Level: Error
Task: DisconnectIndication
Opcode: Info

Message #

A network connection was disconnected.

Server name: %4
Server address: %6!S!
Connection type: %7

Guidance:
This indicates that the client's connection to the server was disconnected.

Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`Address` Binary
`ConnectionType` UInt32
`InterfaceId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30804,
    "version": 2,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-11T17:39:20.782502+00:00",
    "event_record_id": 30,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Reason": 7,
    "Status": 3221225996,
    "InstanceNameLength": 24,
    "InstanceName": "\\Device\\LanmanRedirector",
    "ServerNameLength": 26,
    "ServerName": "\\LAB-DC01.ludus.domain",
    "AddressLength": 16,
    "Address": "020001BD0A020A0B0000000000000000",
    "ConnectionType": 1,
    "InterfaceId": 5
  },
  "message": ""
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Potential CVE-2023-23397 Exploitation Attempt - SMB source medium: Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.↳ also matches Event ID 30803: Failed to establish a network connection., Event ID 30806: The client re-established its session to the server.

Event ID 30805: The client lost its session to the server.

Channel: Connectivity
Level: Warning
Task: SessionFailure
Opcode: Info

Message #

The client lost its session to the server.

Error: %1

Server name: %5
Session ID: %2

Guidance:
If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`Address` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30805,
    "version": 2,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-11T17:39:20.782525+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 3221225996,
    "SessionId": 21990366773273,
    "TreeId": 0,
    "ServerNameLength": 26,
    "ServerName": "\\LAB-DC01.ludus.domain",
    "AddressLength": 0,
    "Address": ""
  },
  "message": ""
}

Event ID 30806: The client re-established its session to the server.

Channel: Connectivity
Level: Informational
Task: SessionEstablished
Opcode: Info

Message #

The client re-established its session to the server.

Server name: %5
Server address: %7!S!
Session ID: %2

Guidance:
You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`Address` Binary
`SigningUsed` Boolean
`EncryptionUsed` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30806,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-11T17:39:20.790247+00:00",
    "event_record_id": 33,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3932
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 0,
    "SessionId": 21990366773289,
    "TreeId": 0,
    "ServerNameLength": 26,
    "ServerName": "\\LAB-DC01.ludus.domain",
    "AddressLength": 16,
    "Address": "020001BD0A020A0B0000000000000000"
  },
  "message": ""
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Potential CVE-2023-23397 Exploitation Attempt - SMB source medium: Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.↳ also matches Event ID 30803: Failed to establish a network connection., Event ID 30804: A network connection was disconnected.

Event ID 30807: The connection to the share was lost.

Channel: Connectivity
Level: Warning
Task: ShareConnectionFailure
Opcode: Info

Message #

The connection to the share was lost.

Error: %1

Share name: %5
Session ID: %2
Tree ID: %3

Guidance:
If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`Address` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30807,
    "version": 2,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-11T17:39:20.782531+00:00",
    "event_record_id": 32,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 3221225996,
    "SessionId": 21990366773273,
    "TreeId": 1,
    "ServerNameLength": 33,
    "ServerName": "\\LAB-DC01.ludus.domain\\sysvol",
    "AddressLength": 0,
    "Address": ""
  },
  "message": ""
}

Event ID 30808: The connection to the share was re-established.

Channel: Connectivity
Level: Informational
Task: ShareConnectionEstablished
Opcode: Info

Message #

The connection to the share was re-established.

Share name: %5
Server address: %7!S!
Session ID: %2
Tree ID: %3

Guidance:
You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`Address` Binary
`SigningUsed` Boolean
`EncryptionUsed` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30808,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-02-11T17:39:20.790983+00:00",
    "event_record_id": 34,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1000
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 0,
    "SessionId": 21990366773289,
    "TreeId": 1,
    "ServerNameLength": 31,
    "ServerName": "\\LAB-DC01.ludus.domain\\IPC$",
    "AddressLength": 16,
    "Address": "020001BD0A020A0B0000000000000000"
  },
  "message": ""
}

Event ID 30809: A request timed out because there was no response from the server.

Channel: Connectivity
Task: ExpiredExchange
Opcode: Info

Message #

A request timed out because there was no response from the server.

Server name: %6
Session ID:%3
Tree ID:%4
Message ID:%2
Command: %1
Instance Name: %9
RetryCount: %10
ElapsedTime(ms): %11

Guidance:
The server is responding over TCP but not over SMB. Ensure the Server service is running and responsive, and the disks do not have high per-IO latency, which makes the disks appear unresponsive to SMB. Also, ensure the server is responsive overall and not paused; for instance, make sure you can log on to it.

Fields #

Name	Description
`Smb2Command` UInt16
`MessageId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`RetryCount` UInt32
`ElapsedTimeInMs` UInt32

Event ID 30810: Added a TCP/IP transport interface.

Channel: Connectivity
Level: Informational
Task: TcpIpTransportArrival
Opcode: Info

Message #

Added a TCP/IP transport interface.

Name: %2
InterfaceIndex: %3

Guidance:
A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString
`IfIndex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30810,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-05-29T16:32:57.4182804+00:00",
    "event_record_id": 49,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 288
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NameLength": "8",
    "Name": "Ethernet",
    "IfIndex": "3"
  },
  "message": "Added a TCP/IP transport interface.\r\n\r\nName: Ethernet\r\nInterfaceIndex: 0x3\r\n\r\nGuidance:\r\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required."
}

Event ID 30811: Deleted a TCP/IP transport interface.

Channel: Connectivity
Level: Informational
Task: TcpIpTransportRemoval
Opcode: Info

Message #

Deleted a TCP/IP transport interface.

Name: %2
InterfaceIndex: %3

Guidance:
A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString
`IfIndex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30811,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2023-11-06T06:25:42.599960+00:00",
    "event_record_id": 84,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 428
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NameLength": 9,
    "Name": "Ethernet1",
    "IfIndex": 4
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 30812: Added a TDI transport interface.

Channel: Connectivity
Level: Informational
Task: TdiTransportArrival
Opcode: Info

Message #

Added a TDI transport interface.

Name: %2

Guidance:
A TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30812,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-05-29T16:32:57.4182136+00:00",
    "event_record_id": 48,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 288
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServerNameLength": "58",
    "ServerName": "\\Device\\NetBT_Tcpip_{2A7BD48E-DDC6-4641-9F41-682F29F1D76C}"
  },
  "message": "Added a TDI transport interface.\r\n\r\nName: \\Device\\NetBT_Tcpip_{2A7BD48E-DDC6-4641-9F41-682F29F1D76C}\r\n\r\nGuidance:\r\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required."
}

Event ID 30813: Deleted a TDI transport interface.

Channel: Connectivity
Level: Informational
Task: TdiTransportRemoval
Opcode: Info

Message #

Deleted a TDI transport interface.

Name: %2

Guidance:
A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 30813,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2023-11-06T06:25:42.600171+00:00",
    "event_record_id": 85,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 224
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ServerNameLength": 58,
    "ServerName": "\\Device\\NetBT_Tcpip_{3D03B11E-98A0-4304-84E2-CD3AAE8EFE1D}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 30814: Witness registration has completed.

Channel: Connectivity
Task: WitnessRegistration
Opcode: Info

Message #

Witness registration has completed.

Status: %1

Cluster share name: %4
Cluster share type: %2
File server cluster address: %6!S!

Guidance:
The client successfully registered with the SMB Witness through RPC using TCP (port 135, then an endpoint port above 1023). No action is required.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ShareType` UInt8
`NameLength` UInt16
`Name` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 30815: Witness deregistration has completed.

Channel: Connectivity
Task: WitnessDeregistration
Opcode: Info

Message #

Witness deregistration has completed.

Status: %1

Cluster share name: %4
Cluster share type: %2

Guidance:
The client successfully de-registered with the SMB Witness through RPC using TCP (port 135, then an endpoint port above 1023). No action is required.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ShareType` UInt8
`NameLength` UInt16
`Name` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 30816: The server failed the negotiate request.

Channel: Connectivity
Task: NegotiateFailure
Opcode: Info

Message #

The server failed the negotiate request.

Error: %2

Server name: %4

Guidance:
The server does not support any dialect that the client is trying to negotiate, such as the client has SMB2/SMB3 disabled and the server has SMB1 disabled.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30817: Close request failed.

Channel: Connectivity
Task: CloseFailure
Opcode: Info

Message #

Close request failed.

Error: %2

Path: %4%6

Guidance:
A persistent handle (Continuous Availability) or a resilient handle failed to close.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString

Event ID 30818: RDMA interfaces are available but the client failed to connect to the server over RDMA transport.

Channel: Connectivity
Task: RdmaFallback
Opcode: Info

Message #

RDMA interfaces are available but the client failed to connect to the server over RDMA transport.

Server name: %2

Guidance:
Both client and server have RDMA (SMB Direct) adaptors but there was a problem with the connection and the client had to fall back to using TCP/IP SMB (non-RDMA).

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30819: The SMB client received a request to move to a different node on a file server cluster.

Channel: Connectivity
Task: WitnessMove
Opcode: Info

Message #

The SMB client received a request to move to a different node on a file server cluster.

File server cluster name: %4
New file server cluster address: %6!S!

Guidance:
Continuous Availability (Transparent Failover) is in use and the client computer is going to move to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ShareType` UInt8
`NameLength` UInt16
`Name` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 30820: The SMB client successfully moved to a different node on a file server cluster.

Channel: Connectivity
Task: WitnessMoveSuccess
Opcode: Info

Message #

The SMB client successfully moved to a different node on a file server cluster.

File server cluster name: %4
 New file server cluster address: %6!S!

Guidance:
Continuous Availability (Transparent Failover) is in use and the client computer successfully moved to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ShareType` UInt8
`NameLength` UInt16
`Name` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 30821: The SMB client failed to move to a different node on a file server cluster.

Channel: Connectivity
Task: WitnessMoveFailure
Opcode: Info

Message #

The SMB client failed to move to a different node on a file server cluster.

Error: %1

File server cluster name: %4

Guidance:
Continuous Availability (Transparent Failover) is in use and the client computer failed to move to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). The attempt to connect to the destination server failed, which is typically due to a network configuration issue. For example, this issue may occur if the destination node's IP address cannot be resolved, if the destination node is behind a firewall, or if there is no network route from the client to the node.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ShareType` UInt8
`NameLength` UInt16
`Name` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 30822: Failed to establish an SMB multichannel network connection.

Channel: Connectivity
Task: MultiChannelNetworkConnectFailure
Opcode: Info

Message #

Failed to establish an SMB multichannel network connection.

Error: %2

Server name: %4
Server address: %6!S!
Client address: %7!S!
Instance name: %9
Connection type: %10

Guidance:
This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue. Since the error occurred while trying to connect extra channels, it will not result in an application error. This event is for diagnostics only.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`RemoteAddress` Binary
`LocalAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`ConnectionType` UInt32
`PortSelectionOrigin` UInt32

Event ID 30823: The connection was terminated due to one or more IO request timeouts.

Channel: Connectivity
Task: HungConnectionFailure
Opcode: Info

Message #

The connection was terminated due to one or more IO request timeouts.

Error: %2

Name: %4
Server address: %6!S!
Client address: %7!S!
Instance name: %9
Connection type: %10

Guidance:
This indicates a problem with the underlying network or the storage stack on the remote server. IO operations were not completed within the allotted time. The application may not see this failure because IOs are usually retried on a different connection. This event is for diagnostics only.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`RemoteAddress` Binary
`LocalAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`ConnectionType` UInt32

Event ID 30824: The connection was forcibly disconnected.

Channel: Connectivity
Task: ConnectionForceDisconnected
Opcode: Info

Message #

The connection was forcibly disconnected. 

Error: %2

Name: %4

Server address: %6!S!
Client address: %7!S!
Instance name: %9
Connection type: %10

Guidance:
This connection is disconnected to force existing requests to fail back as soon as possible. This is a fast-fail mechanism to allow upper layers to apply their recovery policies as soon as possible. This event is for diagnostics only.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString
`AddressLength` UInt32
`RemoteAddress` Binary
`LocalAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`ConnectionType` UInt32

Event ID 30825: The disconnect state on connection was cleared.

Channel: Connectivity
Task: ConnectionDisconnectStateCleared
Opcode: Info

Message #

The disconnect state on connection was cleared 

Name: %3
Instance name: %5

Guidance:
Any persistent disconnect state on this connection is cleared. Any new IO will be sent to the server as usual. This event is for diagnostics only.

Fields #

Name	Description
`Reason` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`InstanceNameLength` UInt16
`InstanceName` UnicodeString

Event ID 30826: The SMB negotiate response processing failed on the client to determine the selected encryption cipher for the client and server.

Channel: Connectivity
Task: NegotiateResponseEncryptionCapabilitiesFailure
Opcode: Info

Description

The SMB negotiate response processing failed on the client to determine the selected encryption cipher for the client and server. Please ensure there is a common cipher between the client and server.

Message #

The SMB negotiate response processing failed on the client to determine the selected encryption cipher for the client and server. Please ensure there is a common cipher between the client and server.

Client encryption cipher suite order (most to least preferred): %2
Server replied back with its selected encryption cipher ID: %4

Fields #

Name	Description
`ClientCipherSuiteOrderLength` UInt32
`ClientCipherSuiteOrder` UnicodeString
`ServerChosenEncryptionCipherLength` UInt32
`ServerChosenEncryptionCipher` UnicodeString

Event ID 30827: Could not find a certificate mapping that matches the server name.

Channel: Connectivity
Level: Informational
Task: CertificateMappingNotFound

Message #

Could not find a certificate mapping that matches the server name. 

Connection type: %1
Server name: %3.

Fields #

Name	Description
`ConnectionType` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 30827,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 288230376151711808,
    "time_created": "2026-05-30T01:32:45.7795907+00:00",
    "event_record_id": 155,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 4056
    },
    "channel": "Microsoft-Windows-SmbClient/Connectivity",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": "4",
    "ServerNameLength": "10",
    "ServerName": "10.2.10.31"
  },
  "message": "Could not find a certificate mapping that matches the server name. \r\n\r\nConnection type: Quic\r\nServer name: 10.2.10.31.\r\n"
}

Event ID 30828: The client established its session to the server.

Channel: Connectivity
Task: SessionEstablishedNoisy
Opcode: Info

Message #

The client established its session to the server.

Server name: %4
Server address: %6!S!
Client address: %8!S!
Session ID: %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`ServerNameLength` UInt16
`ServerName` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`LocalAddressLength` UInt32
`LocalAddress` Binary

Event ID 30829: The client failed to establish its session to the server.

Channel: Connectivity
Task: SessionSetupErrorNoisy
Opcode: Info

Message #

The client failed to establish its session to the server.

Error: %1

Server name: %4
Server address: %6!S!
Client address: %8!S!
Session ID: %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SessionId` UInt64
`ServerNameLength` UInt16
`ServerName` UnicodeString
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`LocalAddressLength` UInt32
`LocalAddress` Binary

Event ID 30830: The SMB redirector selected the connection initiated with the following parameters.

Channel: Connectivity
Level: Informational
Task: SmbConnectionInitiatedSelectedInfo

Message #

The SMB redirector selected the connection initiated with the following parameters:

Server name: %2
Server socket address: %5
Client socket address: %7
Client certificate thumbprint: %12
Transport: %3
Instance Name: %9

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`ConnectionType` UInt32
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`LocalAddressLength` UInt32
`LocalAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`PortSelectionOrigin` UInt32
`Status` HexInt32	NTSTATUS reference
`ConnectionIdSize` UInt32
`ConnectionId` Binary
`ClientCertSha1HashSize` UInt32
`ClientCertSha1Hash` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "event_id": 30830,
    "level": 4,
    "task": 111,
    "opcode": 0,
    "time_created": "2026-05-27T16:40:13.5431275+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-SmbClient"
  },
  "event_data": {
    "LocalAddressLength": "0",
    "ClientCertSha1HashSize": "0",
    "ConnectionIdSize": "0",
    "RemoteAddressLength": "16",
    "ConnectionType": "1",
    "ConnectionId": null,
    "PortSelectionOrigin": "4",
    "ServerName": "JD-DC01-2022.ludus.domain",
    "InstanceNameLength": "24",
    "LocalAddress": null,
    "InstanceName": "\\Device\\LanmanRedirector",
    "ClientCertSha1Hash": null,
    "ServerNameLength": "25",
    "Status": "0x0",
    "RemoteAddress": "020001BD0A020A0B0000000000000000"
  }
}

Event ID 30831: The SMB client was denied access to the SMB server during mutual authentication.

Channel: Connectivity
Task: MutualAuthServerDeniedAccess

Message #

The SMB client was denied access to the SMB server during mutual authentication.

Server name: %2
Server socket address: %5
Client socket address: %7
Client certificate thumbprint: %11
Transport: %3
Instance Name: %9

Fields #

Name	Description
`ServerNameLength` UInt16

Event ID 30832: The SMB connection was successfully established.

Channel: Connectivity
Task: ConnectionEstablished

Message #

The SMB connection was successfully established.

Server name: %2
Server socket address: %5
Client socket address: %7
Connection ID: %12
Client certificate thumbprint: %14
Transport: %3
Instance Name: %9
Port Origin: %10

Guidance:

The event occurs when server authentication succeeds. The connection may later be closed if client authentication fails or if the client is denied access to the server.

Event ID 30833: The initial connection to the share was established.

Channel: Connectivity
Level: Informational
Task: ShareInitialConnectionEstablished

Message #

The initial connection to the share was established.

Share name: %5
Server address: %7!S!
Session ID: %2
Tree ID: %3
Transport type: %8
Signing used: %9
Encryption used: %10
Compression requested: %11
NTLM blocked: %12

Fields #

Name	Description
`Status`
`SessionId`
`TreeId`
`ServerNameLength`
`ServerName`
`AddressLength`
`Address`
`ConnectionType`
`SigningUsed`
`EncryptionUsed`
`CompressionRequested`
`NTLMBlocked`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "event_id": 30833,
    "level": 4,
    "task": 163,
    "opcode": 0,
    "time_created": "2026-05-27T16:40:13.5498689+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-SmbClient"
  },
  "event_data": {
    "NTLMBlocked": "false",
    "EncryptionUsed": "false",
    "ServerName": "\\JD-DC01-2022.ludus.domain\\IPC$",
    "SigningUsed": "true",
    "SessionId": "87974284886033",
    "ConnectionType": "1",
    "TreeId": "1",
    "Address": "020001BD0A020A0B0000000000000000",
    "ServerNameLength": "31",
    "AddressLength": "16",
    "Status": "0",
    "CompressionRequested": "false"
  }
}

Event ID 30834: The client was unable to perform revocation checks on the server certificate chain.

Channel: Connectivity
Task: ServerCertificateRevocationChecksFailed

Description

The client was unable to perform revocation checks on the server certificate chain. The connection will proceed.

Message #

The client was unable to perform revocation checks on the server certificate chain. The connection will proceed.

Verification Status: %1

Server name: %3
Server socket address: %6
Client socket address: %8
Connection ID: %13
Client certificate thumbprint: %15
Transport: %4
Instance Name: %10
Port Origin: %11

Fields #

Name	Description
`HResult` Int32
`ServerNameLength` UInt16

Event ID 30835: Server authentication failed.

Channel: Connectivity
Task: ServerAuthenticationFailure

Message #

Server authentication failed.

Error: %1

Server name: %3
Server socket address: %6
Client socket address: %8
Connection ID: %13
Client certificate thumbprint: %15
Transport: %4
Instance Name: %10
Port Origin: %11

Fields #

Name	Description
`HResult` Int32
`ServerNameLength` UInt16

Event ID 30837: The requested transport is disabled.

Channel: Connectivity
Task: RequestedTransportDisabled

Message #

The requested transport is disabled.

Server name: %2
Server socket address: %5
Transport: %3

Fields #

Name	Description
`ServerNameLength`
`ServerName`
`ConnectionType`
`RemoteAddressLength`
`RemoteAddress`

Event ID 30900: The handle was created without persistence.

Channel: Operational
Task: HandlePersistenceNotGranted
Opcode: Info

Message #

The handle was created without persistence.

File ID: %2:%3
CreateGUID: %4
Path: %10%12

Guidance:
The server supports Continuous Availability (persistent handles) and the request to create the handle succeeded. However, the server did not grant persistence. You should verify that the Resume Key Filter is running on the server and is attached to the target volume.

Fields #

Name	Description
`Object` Pointer
`PersistentFID` UInt64
`VolatileFID` UInt64
`CreateGUID` GUID
`OldState` UInt16
`NewState` UInt16
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`PreviousStatus` UInt32
`PreviousReason` UInt32

Event ID 30904: The server does not support multichannel.

Channel: Operational
Task: ServerMultiChannelIncapable
Opcode: Info

Message #

The server does not support multichannel.

Server name: %2

Guidance:
The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30905: The client cannot connect to the server due to a multichannel constraint registry setting.

Channel: Operational
Task: ServerMultiChannelConstraint
Opcode: Info

Message #

The client cannot connect to the server due to a multichannel constraint registry setting.

Server name: %2

Guidance:
The client attempted to use SMB Multichannel, but an administrator has configured multichannel support to prevent multichannel on the client. You can configure SMB Multichannel on the client using the Windows PowerShell cmdlets: New-SmbMultichannelConstraint and Remove-SmbMultichannelConstraint.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30906: A request on persistent/resilient handle failed because the handle was invalid or it exceeded the timeout.

Channel: Operational
Task: RequestRetryFailure
Opcode: Info

Message #

A request on persistent/resilient handle failed because the handle was invalid or it exceeded the timeout.

Status: %7

Type: %1
Path: %4%6
Restart count: %2

Guidance:
After retrying a request on a Continuously Available (Persistent) handle or a Resilient handle, the client was unable to reconnect the handle. This event is the result of a handle recovery failure. Review other events for more details.

Fields #

Name	Description
`IrpCode` UInt8
`RestartCount` UInt32
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString
`Status` UInt32	NTSTATUS reference
`Reason` UInt32
`HistoryCount` UInt32

Event ID 30907: The SMB Multichannel registry value is not configured with default settings.

Channel: Operational
Task: MultiChannelDisabled
Opcode: Info

Message #

The SMB Multichannel registry value is not configured with default settings.

Default Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"DisableMultiChannel"=dword:0
Configured Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"DisableMultiChannel"=dword:%2

Guidance:
You can configure SMB Multichannel on the client using the Windows PowerShell cmdlet Set-SmbClientConfiguration. Disabling SMB client multichannel support is not a recommended configuration, as it can lead to degraded performance and decreased reliability if one channel or network path fails.

Fields #

Name	Description
`RegName` UnicodeString
`RegValue` UInt32

Event ID 30908: The SMB 3 and SMB 2 driver is not configured with the default start type.

Channel: Operational
Task: Smb2Disabled
Opcode: Info

Message #

The SMB 3 and SMB 2 driver is not configured with the default start type.

Default Start Type: DEMAND_START
Configured Start Type: DISABLED

Guidance:
You should expect this event when disabling SMB2/SMB3 for the client using SC.EXE or editing the Windows registry. Microsoft does not recommend disabling SMB2/SMB3. Disabling SMB2/SMB3 prevents use of features such as SMB Transparent Failover, SMB Scale Out, SMB Multichannel, SMB Direct (RDMA), SMB Encryption, VSS for SMB file shares, and SMB Directory Leasing. SMB provides alternative troubleshooting workarounds to disabling SMB2/SMB3 in most cases.

Fields #

Name	Description
`RegName` UnicodeString
`RegValue` UInt32

Event ID 30909: The client supports SMB Direct (RDMA) and SMB Signing is in use.

Channel: Operational
Task: RdmaWithSigning
Opcode: Info

Message #

The client supports SMB Direct (RDMA) and SMB Signing is in use.

Share name: %2

Guidance:
For optimal SMB Direct performance, you can disable SMB Signing. This configuration is less secure and you should only consider this configuration on trustworthy private networks with strict access control.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30910: The client supports SMB Direct (RDMA) and SMB Encryption is in use.

Channel: Operational
Task: RdmaWithEncryption
Opcode: Info

Message #

The client supports SMB Direct (RDMA) and SMB Encryption is in use.

Share name: %2

Guidance:
For optimal SMB Direct performance, you can disable SMB Encryption on the server for shares accessed by this client. This configuration is less secure and you should only consider this configuration on trustworthy private networks with strict access control.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 30911: The Cipher Suite Order group policy setting is invalid.

Channel: Operational
Task: InvalidCipherSuiteOrder
Opcode: Info

Message #

The Cipher Suite Order group policy setting is invalid.

Guidance:

This event indicates that an administrator has configured an invalid value for the "Computer Configuration\Administrative Templates\Network\Lanman Workstation\Cipher Suite Order" group policy setting. The client will use the default cipher suite order "%1" until this error is resolved.

Fields #

Name	Description
`CipherSuiteOrder` UnicodeString

Event ID 30912: The RequireSecureNegotiate setting has been removed.

Channel: Operational
Task: RequireSecureNegotiateIsDeprecated
Opcode: Info

Message #

The RequireSecureNegotiate setting has been removed.

Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
Registry Value: RequireSecureNegotiate

Guidance:

You should expect this event when an administrator configures the RequireSecureNegotiate setting. Secure negotiate prevents man-in-the-middle attacks against SMB connection establishment. Previous versions of Windows allowed secure negotiate to be disabled. Disabling secure negotiate is no longer allowed. The client removed the setting from the registry. No user action is required.

Event ID 30913: Server ServerName share ShareName has requested client to use isolated connections to connection to the share.

Channel: Operational
Task: IsolatedTransportServerEntryInfo
Opcode: Info

Description

Server ServerName share ShareName has requested client to use isolated connections to connection to the share. Asymmetric flag AsymmetricFlag. Isolated transport flag IsolatedTransportFlag. NetRoot already use isolated connections IsIsolatedTransportServerEntry.

Message #

Server %2 share %4 has requested client to use isolated connections to connection to the share. Asymmetric flag %5. Isolated transport flag %6. NetRoot already use isolated connections %7.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`ShareNameLength` UInt16
`ShareName` UnicodeString
`AsymmetricFlag` Boolean
`IsolatedTransportFlag` Boolean
`IsIsolatedTransportServerEntry` Boolean

Event ID 30914: RDMA rundown is active.

Channel: Operational
Task: SmbRdmaRundownActive

Description

RDMA rundown is active. Active RDMA-based operations will be wound down. There are currently ActiveRdmaResourceCount active RDMA resources.

Message #

RDMA rundown is active. Active RDMA-based operations will be wound down. There are currently %1 active RDMA resources.

Fields #

Name	Description
`ActiveRdmaResourceCount` UInt32

Event ID 30915: RDMA rundown is complete.

Channel: Operational
Task: SmbRdmaRundownComplete

Description

RDMA rundown is complete. No further RDMA-based operations are allowed. Rundown no-op: NoOp.

Message #

RDMA rundown is complete. No further RDMA-based operations are allowed. Rundown no-op: %1.

Fields #

Name	Description
`NoOp` Boolean

Event ID 30916: Reactivation of RDMA support has commenced.

Channel: Operational
Task: SmbRdmaReactivation

Event ID 30917: RDMA is no longer disabled.

Channel: Operational
Task: SmbRdmaReactivationComplete

Description

RDMA is no longer disabled. RDMA-based operations can proceed, given hardware capabilities and OS policy. No-op: NoOp.

Message #

RDMA is no longer disabled. RDMA-based operations can proceed, given hardware capabilities and OS policy. No-op: %1.

Fields #

Name	Description
`NoOp` Boolean

Event ID 30918: SMBDirect load attempt complete.

Channel: Operational
Task: SmbRdmaSMBDirectLoad

Message #

SMBDirect load attempt complete.

Success: %1
Status code: %2
Service path: %4

Fields #

Name	Description
`IsSuccess` Boolean
`LoadStatus` HexInt32
`ServicePathLength` UInt16
`ServicePath` UnicodeString
`DeviceNameLength` UInt16
`DeviceName` UnicodeString

Event ID 30950: Component capabilities: ComponentCapabilities.

Channel: Operational
Level: Informational
Task: SmbComponentCapabilities

Message #

Component capabilities: %1
Internal patch number: %2

Fields #

Name	Description
`ComponentCapabilities` HexInt32
`PatchNumber` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "event_id": 30950,
    "level": 4,
    "task": 128,
    "opcode": 0,
    "time_created": "2026-04-18T03:03:29.0487441+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-SMBClient"
  },
  "event_data": {
    "ComponentCapabilities": "0x3",
    "PatchNumber": "0x0"
  }
}

Event ID 30951: The alternative port PortNumber is not a valid port within the range 0 to 65535 for mapping name ServerName:TransportName.

Channel: Operational
Task: SmbInvalidPortSpecified

Message #

The alternative port %1 is not a valid port within the range 0 to 65535 for mapping name %3:%5.

Fields #

Name	Description
`PortNumber` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`TransportNameLength` UInt16
`TransportName` UnicodeString

Event ID 30952: The SMB redirector did not select the connection initiated with the following parameters.

Channel: Operational
Task: SmbConnectionInitiatedNotSelectedInfo

Message #

The SMB redirector did not select the connection initiated with the following parameters:

Server name: %2
IP Address: %5
Transport: %3
Instance Name:%7
Port Origin: %8

The failure status associated with this decision: %9

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`ConnectionType` UInt32
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`PortSelectionOrigin` UInt32
`Status` HexInt32	NTSTATUS reference

Event ID 30953: SMB Dialect Change.

Channel: Operational
Task: SmbDialectChange

Message #

SMB Dialect Change

%1 was changed from %2 to %3.

Fields #

Name	Description
`SmbDialect` UnicodeString
`OldDialect` HexInt32
`NewDialect` HexInt32

Event ID 30954: It took CallDuration secs to execute FunctionName.

Channel: HelperClassDiagnostic
Task: SmbLsassCallDurationInfo

Message #

It took %2 secs to execute %1.

Fields #

Name	Description
`FunctionName` UInt32
`CallDuration` Int32
`ThresholdDuration` Int32

Event ID 30955: It took CallDuration secs to execute FunctionName which is longer than threshold of ThresholdDuration secs.

Channel: Operational
Task: SmbLsassCallDurationWarning

Description

It took CallDuration secs to execute FunctionName which is longer than threshold of ThresholdDuration secs. This warning is because FunctionName is taking longer than expected.

Message #

It took %2 secs to execute %1 which is longer than threshold of %3 secs. This warning is because %1 is taking longer than expected.

Fields #

Name	Description
`FunctionName` UInt32
`CallDuration` Int32
`ThresholdDuration` Int32

Event ID 31000: Reason.

Channel: Security
Task: AcquireCredHandleFailure
Opcode: Info

Description

Reason. Error: Status Security status: SecurityStatus User name: UserName Logon ID: LogonId Serrver name: ServerName

Message #

%1.

Error: %2

Security status: %3
User name: %10
Logon ID: %4
Serrver name: %6

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`SecurityStatus` UInt32
`LogonId` UInt64
`ServerNameLength` UInt16
`ServerName` UnicodeString
`PrincipalNameLength` UInt16
`PrincipalName` UnicodeString
`UserNameLength` UInt16
`UserName` UnicodeString

Event ID 31001: Reason.

Channel: Security
Level: Error
Task: ISCFailure
Opcode: Info

Description

Reason. Error: Status Security status: SecurityStatus User name: UserName Logon ID: LogonId Server name: ServerName Principal name: PrincipalName

Message #

%1.

Error: %2

Security status: %3
User name: %10
Logon ID: %4
Server name: %6
Principal name: %8

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`SecurityStatus` UInt32
`LogonId` UInt64
`ServerNameLength` UInt16
`ServerName` UnicodeString
`PrincipalNameLength` UInt16
`PrincipalName` UnicodeString
`UserNameLength` UInt16
`UserName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 31001,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 144115188075856000,
    "time_created": "2026-02-18T21:49:45.360595+00:00",
    "event_record_id": 101,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1456
    },
    "channel": "Microsoft-Windows-SmbClient/Security",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Reason": 10,
    "Status": 3221225779,
    "SecurityStatus": 3221225779,
    "LogonId": 999,
    "ServerNameLength": 13,
    "ServerName": "\\LAB-DC01",
    "PrincipalNameLength": 17,
    "PrincipalName": "cifs/LAB-DC01",
    "UserNameLength": 0,
    "UserName": ""
  },
  "message": ""
}

Event ID 31002: The outbound authentication failed using a network token.

Channel: Security
Level: Error
Task: NetworkTokenFailure
Opcode: Info

Message #

The outbound authentication failed using a network token.

Error: %2

Server name: %4

Guidance:
This typically indicates that delegation must be configured for a Kerberos double-hop scenario. If delegation is configured, confirm that the services are configured correctly on the middle-tier server.

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ServerNameLength` UInt16
`ServerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 31002,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 144115188075856000,
    "time_created": "2026-05-30T01:48:18.2581895+00:00",
    "event_record_id": 1589,
    "correlation": {},
    "execution": {
      "process_id": 1900,
      "thread_id": 10424
    },
    "channel": "Microsoft-Windows-SmbClient/Security",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Reason": "11",
    "Status": "3221225506",
    "ServerNameLength": "11",
    "ServerName": "\\10.2.10.11"
  },
  "message": "The outbound authentication failed using a network token.\r\n\r\nError: {Access Denied}\r\nA process has requested access to an object, but has not been granted those access rights.\r\n\r\nServer name: \\10.2.10.11\r\n\r\nGuidance:\r\nThis typically indicates that delegation must be configured for a Kerberos double-hop scenario. If delegation is configured, confirm that the services are configured correctly on the middle-tier server."
}

Event ID 31003: The LmCompatibilityLevel value is different from the default.

Channel: Security
Level: Warning
Task: LMCompatibilityLevel
Opcode: Info

Message #

The LmCompatibilityLevel value is different from the default.

Configured LM Compatibility Level: %2
Default LM Compatibility Level: 3

Guidance:
LAN Manager (LM) authentication is the protocol used to authenticate Windows clients for network operations. This includes joining a domain, accessing network resources, and authenticating users or computers. This determines which challenge/response authentication protocol is negotiated between the client and the server computers. Specifically, the LM authentication level determines which authentication protocols the client will try to negotiate or the server will accept. The value set for LmCompatibilityLevel determines which challenge/response authentication protocol is used for network logons. This value affects the level of authentication protocol that clients use, the level of session security negotiated, and the level of authentication accepted by servers.

Value (Setting) - Description

0 (Send LM & NTLM responses) - Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

1 (Send LM & NTLM - use NTLMv2 session security if negotiated) - Clients use LM and NTLM authentication, and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

2 (Send NTLM response only) - Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

3 (Send NTLM v2 response only) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

4 (Send NTLMv2 response only/refuse LM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and accept only NTLM and NTLMv2 authentication.

5 (Send NTLM v2 response only/refuse LM & NTLM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM and accept only NTLMv2 authentication.

Incompatibly configured  LmCompatibility levels between a client and server (such as 0 on a client and 5 on a server) prevent access to the server. Non-Microsoft clients and servers also provide these configuration settings.

Fields #

Name	Description
`RegName` UnicodeString
`RegValue` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 31003,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 144115188075856000,
    "time_created": "2026-03-14T00:02:38.010007+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 992
    },
    "channel": "Microsoft-Windows-SmbClient/Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RegName": "LMCompatibilityLevel",
    "RegValue": 5
  },
  "message": ""
}

Event ID 31010: The SMB client failed to connect to the share.

Channel: Security
Level: Error
Task: TreeConnectFailure
Opcode: Info

Message #

The SMB client failed to connect to the share.

Error: %2

Path: %4%6

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`ShareNameLength` UInt16
`ShareName` UnicodeString
`ObjectNameLength` UInt16
`ObjectName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "988C59C5-0A1C-45B6-A555-0C62276E327D",
    "event_source_name": "",
    "event_id": 31010,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 144115188075856128,
    "time_created": "2026-03-13T17:13:50.805757+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Microsoft-Windows-SmbClient/Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Reason": 12,
    "Status": 3221225506,
    "ShareNameLength": 14,
    "ShareName": "\\10.2.10.21\\C$",
    "ObjectNameLength": 0,
    "ObjectName": ""
  },
  "message": ""
}

Event ID 31012: The negotiate validation failed.

Channel: Security
Task: NegotiateValidationFailure
Opcode: Info

Message #

The negotiate validation failed.

From negotiate response:
Dialect: %1
SecurityMode: %2
Capabilities: %3
ServerGuid: %4

From FSCTL_VALIDATE_NEGOTIATE_INFO response:
Dialect: %5
SecurityMode: %6
Capabilities: %7
ServerGuid: %8

Guidance:
The client successfully negotiated SMB dialect, security mode, capabilities and server GUID with the server, but the validation of these values then failed after connecting to a share. This may be due to a "adversary-in-the-middle" compromise attempt.

Fields #

Name	Description
`Dialect` UInt16
`SecurityMode` UInt16
`Capabilities` UInt32
`Guid` GUID
`Dialect2` UInt16
`SecurityMode2` UInt16
`Capabilities2` UInt32
`Guid2` GUID

Event ID 31013: The signing validation failed.

Channel: Security
Task: SigningFailure
Opcode: Info

Message #

The signing validation failed.

Error:%7

Server name: %6
Session ID:%3
Tree ID:%4
Message ID:%2
Command: %1

Guidance:
This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt.

PacketFragment:%9

Fields #

Name	Description
`Smb2Command` UInt16
`MessageId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`MessageSize` UInt32
`FragmentOffset` UInt32
`FragmentSize` UInt32
`FragmentData` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`LocalAddressLength` UInt32
`LocalAddress` Binary

Event ID 31014: The client received an unencrypted message when encryption was expected.

Channel: Security
Task: EncryptionFailure
Opcode: Info

Message #

The client received an unencrypted message when encryption was expected.

Server name: %6
Session ID:%3
Tree ID:%4
Message ID:%2
Command: %1
Instance Name: %9

Guidance:
This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt.

Fields #

Name	Description
`Smb2Command` UInt16
`MessageId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`RetryCount` UInt32
`ElapsedTimeInMs` UInt32
`RemoteAddressLength` UInt32
`RemoteAddress` Binary
`LocalAddressLength` UInt32
`LocalAddress` Binary

Event ID 31015: Failed to decrypt an encrypted SMB message.

Channel: Security
Task: DecryptionFailure
Opcode: Info

Message #

Failed to decrypt an encrypted SMB message.

Error:%7

Server name: %6
Session ID:%3
Instance Name: %9

Guidance:
The client received an encrypted SMB message but cannot decrypt the data. This typically means that the communication came from a previous session that no longer exists. The encryption header may also have been damaged or tampered with on the network between the client and server.

Fields #

Name	Description
`Smb2Command` UInt16
`MessageId` UInt64
`SessionId` UInt64
`TreeId` UInt32
`ServerNameLength` UInt16
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`RetryCount` UInt32
`ElapsedTimeInMs` UInt32

Event ID 31016: The SMB Signing registry value is not configured with default settings.

Channel: Security
Task: EnableSecuritySignatureNonDefault
Opcode: Info

Message #

The SMB Signing registry value is not configured with default settings.

Default Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"EnableSecuritySignature"=dword:1
Configured Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"EnableSecuritySignature"=dword:0

Guidance:
Even though you can disable, enable, or require SMB Signing, the negotiation rules changed starting with SMB2 and not all combinations operate like SMB1.

The effective behavior for SMB2/SMB3 is:
Client Required and Server Required = Signed
Client Not Required and Server Required = Signed
Server Required and Client Not Required = Signed
Server Not Required and Client Not Required = Not Signed

When requiring SMB Encryption, SMB Signing is not used, regardless of settings. SMB Encryption implicitly provides the same integrity guarantees as SMB Signing.

Fields #

Name	Description
`RegName` UnicodeString
`RegValue` UInt32

Event ID 31017: Rejected an insecure guest logon.

Channel: Security
Level: Error
Task: RejectedInsecureGuestAuth
Opcode: Info

Message #

Rejected an insecure guest logon.

User name: %2
Server name: %4

Guidance:
This event indicates that the server attempted to log the user on as an unauthenticated guest and was denied by the client. Guest logons do not support standard security features such as signing and encryption. As a result, guest logons are vulnerable to man-in-the-middle attacks that can expose sensitive data on the network. Windows disables insecure guest logons by default. Microsoft does not recommend enabling insecure guest logons.

Fields #

Name	Description	Rules
`UserNameLength` UInt16
`UserName` UnicodeString
`ServerNameLength` UInt16
`ServerName` UnicodeString		1 detection rule

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 31017,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 144115188075856000,
    "time_created": "2026-03-18T00:09:50.2141543+00:00",
    "event_record_id": 333,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 6232
    },
    "channel": "Microsoft-Windows-SmbClient/Security",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UserNameLength": "0",
    "UserName": "",
    "ServerNameLength": "11",
    "ServerName": "\\10.2.10.31"
  },
  "message": "Rejected an insecure guest logon.\r\n\r\nUser name: \r\nServer name: \\10.2.10.31\r\n\r\nGuidance:\r\nThis event indicates that the server attempted to log the user on as an unauthenticated guest and was denied by the client. Guest logons do not support standard security features such as signing and encryption. As a result, guest logons are vulnerable to man-in-the-middle attacks that can expose sensitive data on the network. Windows disables insecure guest logons by default. Microsoft does not recommend enabling insecure guest logons."
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Suspicious Rejected SMB Guest Logon From IP source medium: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler ServiceT1110, T1110.001

Event ID 31018: Guidance: An administrator has enabled AllowInsecureGuestAuth.

Channel: Security
Task: InsecureGuestAuthEnabled
Opcode: Info

Description

Guidance: An administrator has enabled AllowInsecureGuestAuth. Clients using insecure guest logons are more vulnerable to attackers-in-the-middle, phishing, and malware.

Message #

Guidance: An administrator has enabled AllowInsecureGuestAuth. Clients using insecure guest logons are more vulnerable to attackers-in-the-middle, phishing, and malware.

Fields #

Name	Description	Rules
`RegName` UnicodeString		1 detection rule
`RegValue` UInt32		1 detection rule

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

SMB insecure guest authentication activated (native) source medium: Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.T1021, T1021.002, T1562, T1562.010

Event ID 31019: Mutual authentication was unexpectedly lost after re-authenticating to ServerName.

Channel: Security
Task: MADowngradeDetected
Opcode: Info

Message #

Mutual authentication was unexpectedly lost after re-authenticating to %6
User %8
LogonID %4
Status %2
 AuthProtocol Old %9  New %10
MutualAuthState Old %11 New %12
Clustered %13

Fields #

Name	Description
`Reason` UInt32
`Status` UInt32	NTSTATUS reference
`SecurityStatus` UInt32
`LogonId` UInt64
`ServerNameLength` UInt16
`ServerName` UnicodeString
`UserNameLength` UInt16
`UserName` UnicodeString
`OldAuthProtocolId` UInt16
`NewAuthProtocolId` UInt16
`OldMutualAuthState` Boolean
`NewMutualAuthState` Boolean
`ClusteredServer` Boolean

Event ID 31020: Session key for connection is weaker than required.

Channel: Security
Task: SessionKeyTooShort
Opcode: Info

Description

Session key for connection is weaker than required. Connection will be closed as a result.

Message #

Session key for connection is weaker than required. Connection will be closed as a result.

Server: %2
User: %6
Session key length: %3
Required Session key length: %4

Guidance:
To establish a connection with a shorter session key, set the following registry DWORD value name with the value as decimal bits:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"MinimumSessionKeyLength"

Important: If you have configured the 'Network security: Configure encryption types allowed for Kerberos' security policy to prevent use of 256-bit keys but also set the MinimumSessionKeyLength greater than 128 bits, the computer will not be able to make SMB connections. Setting MinimumSessionKeyLength higher than 128 bits will also prevent SMB connections using NTLM.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`SessionKeyLength` UInt32
`RequiredSessionKeyLength` UInt32
`SessionId` UInt64
`UserName` UnicodeString
`AuthProtocol` UInt32

Event ID 31021: SMB DDP security changed from OldValue to NewValue.

Channel: Security
Task: DirectDataPlacementSecurity

Message #

SMB DDP security changed from %1 to %2.

Fields #

Name	Description
`OldValue` UInt32
`NewValue` UInt32

Event ID 31022: Allowed an insecure guest logon.

Channel: Security
Task: AllowedInsecureGuestAuth

Message #

Allowed an insecure guest logon.

User name: %2
Server name: %4

Guidance:
This event indicates that the server attempted to log the user on as an unauthenticated guest and was allowed by the client.

Fields #

Name	Description
`UserNameLength` UInt16
`UserName` UnicodeString
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 31023: NTLM is prohibited for authentication on the server.

Channel: Security
Task: NTLMBlocked

Message #

NTLM is prohibited for authentication on the server 

Server name: %2

 NTLM was disabled by user or by administrator using policies. For more information: https://go.microsoft.com/fwlink/?linkid=2267451.

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 31997: The SMB client was logged on as Guest account.

Channel: Audit
Task: InsecureGuestLogon

Message #

The SMB client was logged on as Guest account.

Server name: %2

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 31998: The SMB client observed that the server doesn't support signing.

Channel: Audit
Task: ServerDoesNotSupportSigning

Message #

The SMB client observed that the server doesn't support signing.

Server name: %2
Client requires signing: %3

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`ClientRequireSigning` Boolean

Event ID 31999: The SMB client observed that the server doesn't support encryption.

Channel: Audit
Task: ServerDoesNotSupportEncryption

Message #

The SMB client observed that the server doesn't support encryption.

Server name: %2
Client requires encyption: %3

Fields #

Name	Description
`ServerNameLength` UInt16
`ServerName` UnicodeString
`ClientRequireEncryption` Boolean

Event ID 32000: SMB1 negotiate response received from remote device when SMB1 cannot be negotiated by the local computer.

Channel: Audit
Task: UnexpectedSMB1ResponseReceived
Opcode: Info

Message #

SMB1 negotiate response received from remote device when SMB1 cannot be negotiated by the local computer. 

Dialect: %1

 Server name: %3

 Guidance:
The client has SMB1 disabled or uninstalled. For more information: https://go.microsoft.com/fwlink/?linkid=852747.

Fields #

Name	Description
`Reason` UInt32
`Dialect` UInt16
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 32002: The local computer received an SMB1 negotiate response.

Channel: Audit
Task: SMB1ResponseReceived
Opcode: Info

Message #

The local computer received an SMB1 negotiate response.

Dialect: %2

 SecurityMode %3

 Server name: %5

 Guidance:
 SMB1 is deprecated and should not be installed nor enabled. For more information, see https://go.microsoft.com/fwlink/?linkid=852747.

Fields #

Name	Description
`Reason` UInt32
`Dialect` UInt16
`SecurityMode` UInt16
`ServerNameLength` UInt16
`ServerName` UnicodeString

Event ID 32003: The local computer didn't received an SMB1 negotiate response in the last Days days.

Channel: Audit
Task: UninstallSMB1Client
Opcode: Info

Description

The local computer didn't received an SMB1 negotiate response in the last Days days.n.

Message #

The local computer didn't received an SMB1 negotiate response in the last %1 days.n
Guidance:

This event indicates that after detecting no attempts to contact this computer via the SMB1 protocol for %1 online days, the SMB1 Client service was automatically uninstalled. The computer must be restarted for SMB1 removal to take effect.

Fields #

Name	Description
`Days` UInt32

Event ID 32004: SMB2 rxcontext performance work started

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: Smb2PerfRxContextStart
Opcode: win:Start

Fields #

Name	Description
`RxContext` UInt64
`FileNameLength` UInt16
`FileName` UnicodeString
`MajorFunction` UInt8
`MinorFunction` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 32004,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x1000000000000400",
    "time_created": "2026-06-02T06:03:00.005+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-FDCB-90720FEEDC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 14624
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "",
    "FileNameLength": 0,
    "MajorFunction": 14,
    "MinorFunction": 0,
    "RxContext": 18446670449117978064
  },
  "message": "Smb2PerfRxContextStart"
}

Event ID 32005: SMB2 exchange performance work started

Channel: Analytic
Task: Smb2PerfExchangeStart
Opcode: Start

Fields #

Name	Description
`Exchange` UInt64
`MajorFunction` UInt8
`MinorFunction` UInt8

Event ID 32006: SMB2 buffer context performance work started

Channel: Analytic
Task: Smb2PerfBufferContextStart
Opcode: Start

Fields #

Name	Description
`BufferContext` UInt64
`MajorFunction` UInt8
`MinorFunction` UInt8
`Smb2Command` UInt16

Event ID 32007: SMB2 performance work transition

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: Smb2PerfWorkTransition
Opcode: win:Info

Fields #

Name	Description
`BlockType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 32007,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": "0x1000000000002000",
    "time_created": "2026-06-02T06:03:00.005+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-FDCB-90720FEEDC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 14624
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BlockType": 1
  },
  "message": "Smb2PerfWorkTransition"
}

Event ID 32008: SMB2 rxcontext performance work read summary

Channel: Analytic
Task: Smb2PerfRxContextReadSummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`FileObject` UInt64
`IRP` UInt64
`ByteCount` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`ReadProcessing` UInt64
`HitCountReadProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64
`AttemptTurboIORead` UInt64
`HitCountAttemptTurboIORead` UInt64
`AttemptTurboIOInit` UInt64
`HitCountAttemptTurboIOInit` UInt64
`TurboIORxCompletion` UInt64
`HitCountTurboIORxCompletion` UInt64

Event ID 32009: SMB2 rxcontext performance work write summary

Channel: Analytic
Task: Smb2PerfRxContextWriteSummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`FileObject` UInt64
`IRP` UInt64
`ByteCount` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`WriteProcessing` UInt64
`HitCountWriteProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64
`AttemptTurboIOWrite` UInt64
`HitCountAttemptTurboIOWrite` UInt64
`AttemptTurboIOInit` UInt64
`HitCountAttemptTurboIOInit` UInt64
`TurboIORxCompletion` UInt64
`HitCountTurboIORxCompletion` UInt64

Event ID 32010: SMB2 rxcontext performance work create summary

Channel: Analytic
Task: Smb2PerfRxContextCreateSummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`IRP` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`CreateProcessing` UInt64
`HitCountCreateProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64

Event ID 32011: SMB2 rxcontext performance work close summary

Channel: Analytic
Task: Smb2PerfRxContextCloseSummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`IRP` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`CloseProcessing` UInt64
`HitCountCloseProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64

Event ID 32012: SMB2 rxcontext performance work query directory summary

Channel: Analytic
Task: Smb2PerfRxContextQueryDirectorySummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`IRP` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`QueryDirectoryProcessing` UInt64
`HitCountQueryDirectoryProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64

Event ID 32013: SMB2 rxcontext performance work fsctl summary

Channel: Analytic
Task: Smb2PerfRxContextFsctlSummary

Fields #

Name	Description
`RxContext` UInt64
`InstanceId` UInt8
`IRP` UInt64
`TotalDuration` UInt64
`Construction` UInt64
`HitCountConstruction` UInt64
`DispatchProcessing` UInt64
`HitCountDispatchProcessing` UInt64
`FsctlProcessing` UInt64
`HitCountFsctlProcessing` UInt64
`CallMiniRdr_MRXSMB` UInt64
`HitCountCallMiniRdr_MRXSMB` UInt64
`LowIoCompletionRoutine` UInt64
`HitCountLowIoCompletionRoutine` UInt64
`CompleteIRP` UInt64
`HitCountCompleteIRP` UInt64
`PostIOCompletion` UInt64
`HitCountPostIOCompletion` UInt64
`PostIORetry` UInt64
`HitCountPostIORetry` UInt64

Event ID 32028: SMB2 exchange performance work read summary

Channel: Analytic
Task: Smb2PerfExchangeReadSummary

Fields #

Name	Description
`Exchange` UInt64
`RxContext` UInt64
`ByteCount` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`ReadStart` UInt64
`HitCountReadStart` UInt64
`ReadBuildAndSendChunks` UInt64
`HitCountReadBuildAndSendChunks` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64
`TurboIOStart` UInt64
`HitCountTurboIOStart` UInt64
`TurboIOComplete` UInt64
`HitCountTurboIOComplete` UInt64

Event ID 32029: SMB2 exchange performance work write summary

Channel: Analytic
Task: Smb2PerfExchangeWriteSummary

Fields #

Name	Description
`Exchange` UInt64
`RxContext` UInt64
`ByteCount` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`WriteStart` UInt64
`HitCountWriteStart` UInt64
`WriteBuildAndSendChunks` UInt64
`HitCountWriteBuildAndSendChunks` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64
`TurboIOStart` UInt64
`HitCountTurboIOStart` UInt64
`TurboIOComplete` UInt64
`HitCountTurboIOComplete` UInt64

Event ID 32030: SMB2 exchange performance work create summary

Channel: Analytic
Task: Smb2PerfExchangeCreateSummary

Fields #

Name	Description
`Exchange` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`CreateStart` UInt64
`HitCountCreateStart` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64

Event ID 32031: SMB2 exchange performance work close summary

Channel: Analytic
Task: Smb2PerfExchangeCloseSummary

Fields #

Name	Description
`Exchange` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`CloseStart` UInt64
`HitCountCloseStart` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64

Event ID 32032: SMB2 exchange performance work query directory summary

Channel: Analytic
Task: Smb2PerfExchangeQueryDirectorySummary

Fields #

Name	Description
`Exchange` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`QueryDirectoryStart` UInt64
`HitCountQueryDirectoryStart` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64

Event ID 32033: SMB2 exchange performance work fsctl summary

Channel: Analytic
Task: Smb2PerfExchangeFsctlSummary

Fields #

Name	Description
`Exchange` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`RestartCount` UInt64
`ResolvingConnectionObjects` UInt64
`HitCountResolvingConnectionObjects` UInt64
`CommandProcessing` UInt64
`HitCountCommandProcessing` UInt64
`FsctlStart` UInt64
`HitCountFsctlStart` UInt64
`CommandFinalizationCallback` UInt64
`HitCountCommandFinalizationCallback` UInt64
`Finalize` UInt64
`HitCountFinalize` UInt64
`PostFinalizeWorker` UInt64
`HitCountPostFinalizeWorker` UInt64
`FinalizeWorkerHitCount` UInt64
`HitCountFinalizeWorkerHitCount` UInt64

Event ID 32048: SMB2 buffer context performance work read summary

Channel: Analytic
Task: Smb2PerfBufferContextReadSummary

Fields #

Name	Description
`BufferContext` UInt64
`Exchange` UInt64
`ByteCount` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`WriteRDMABufferRegistration` UInt64
`HitCountWriteRDMABufferRegistration` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`ReadReceive` UInt64
`HitCountReadReceive` UInt64

Event ID 32049: SMB2 buffer context performance work write summary

Channel: Analytic
Task: Smb2PerfBufferContextWriteSummary

Fields #

Name	Description
`BufferContext` UInt64
`Exchange` UInt64
`ByteCount` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`ReadRDMABufferRegistration` UInt64
`HitCountReadRDMABufferRegistration` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`WriteReceive` UInt64
`HitCountWriteReceive` UInt64

Event ID 32050: SMB2 buffer context performance work create summary

Channel: Analytic
Task: Smb2PerfBufferContextCreateSummary

Fields #

Name	Description
`BufferContext` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`CreateReceive` UInt64
`HitCountCreateReceive` UInt64

Event ID 32051: SMB2 buffer context performance work close summary

Channel: Analytic
Task: Smb2PerfBufferContextCloseSummary

Fields #

Name	Description
`BufferContext` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`CloseReceive` UInt64
`HitCountCloseReceive` UInt64

Event ID 32052: SMB2 buffer context performance work query directory summary

Channel: Analytic
Task: Smb2PerfBufferContextQueryDirectorySummary

Fields #

Name	Description
`BufferContext` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`QueryDirectoryReceive` UInt64
`HitCountQueryDirectoryReceive` UInt64

Event ID 32053: SMB2 buffer context performance work fsctl summary

Channel: Analytic
Task: Smb2PerfBufferContextFsctlSummary

Fields #

Name	Description
`BufferContext` UInt64
`InstanceId` UInt8
`TotalDuration` UInt64
`Initialized` UInt64
`HitCountInitialized` UInt64
`RDMAGetDescriptors` UInt64
`HitCountRDMAGetDescriptors` UInt64
`AssociateMID` UInt64
`HitCountAssociateMID` UInt64
`Assembly` UInt64
`HitCountAssembly` UInt64
`BeginSmbSend` UInt64
`HitCountBeginSmbSend` UInt64
`BeginSmbSendAsyncPostWorkerCount` UInt64
`HitCountBeginSmbSendAsyncPostWorkerCount` UInt64
`SmbdPrepareSend` UInt64
`HitCountSmbdPrepareSend` UInt64
`ServerTimeTakenToReply` UInt64
`HitCountServerTimeTakenToReply` UInt64
`FsctlReceive` UInt64
`HitCountFsctlReceive` UInt64

Event ID 32068: SMB2 FCB capture summary

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: Smb2PerfFCBCaptureSummary
Opcode: win:Info

Fields #

Name	Description
`InstanceId` UInt8
`PrefixLength` UInt16
`Prefix` UnicodeString
`ServerShareLength` UInt16
`ServerShare` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 32068,
    "version": 0,
    "level": 4,
    "task": 26,
    "opcode": 0,
    "keywords": "0x1000000000001000",
    "time_created": "2026-06-02T04:01:25.060+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 10452,
      "thread_id": 9120
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InstanceId": 0,
    "Prefix": "\\ludus.domain\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\Machine",
    "PrefixLength": 69,
    "ServerShare": "\\JD-DC01-2022.ludus.domain\\SysVol",
    "ServerShareLength": 33
  },
  "message": "Smb2PerfFCBCaptureSummary"
}

Event ID 40000: Packet (PacketSize bytes).

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: Packet
Opcode: Info

Message #

Packet (%4 bytes)

Fields #

Name	Description
`ConnectionType` UInt32
`PeerAddressLength` UInt32
`PeerAddress` Binary
`PacketSize` UInt32
`PacketData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SMBClient",
    "guid": "{988C59C5-0A1C-45B6-A555-0C62276E327D}",
    "event_source_name": "",
    "event_id": 40000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0800040000000000",
    "time_created": "2026-06-02T06:02:54.813+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000011-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 8936
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "PacketData": "FE534D4240000100000000000400010018000000000000000600000000000000FFFE0000010000002D0000C0006000000C3555C95D82470760BFBAA6B8B39F0404000000",
    "PacketSize": 68,
    "PeerAddress": "020001BD0A020A0B000000000000000002311DCA79F431303A1A0D31",
    "PeerAddressLength": 28
  },
  "message": "Packet "
}

Provenance

ETW provider GUID {988C59C5-0A1C-45B6-A555-0C62276E327D}

Defined in mrxsmb.sys, the binary that emits these events.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB