Microsoft-Windows-SMBWitnessClient
42 events across 2 channels
Event ID 1: Witness Client initialization failed with error (ErrorCode).
#Event ID 2: Witness Client received registration request for \\NetName\ShareName with IP address WitnessServerIP.
#Event ID 3: Witness Client failed to obtain the list of Witness Servers from IP address WitnessServerIP with error (Error).
#Event ID 4: Witness Client is waiting to receive list of Witness Servers from IP address WitnessServerIP.
#Event ID 5: Witness Client selected WitnessServerIP as the Witness Server for NetName \\NetName.
#Event ID 6: Witness Client failed to find a Witness Server for NetName \\NetName with error (ErrorCode).
#Event ID 7: Witness Client successfully registered with Witness Server WitnessServerIP for notification on NetName \\NetName with IP address FileServerIP.
#Event ID 8: Witness Client failed to register with Witness Server WitnessServerIP for notification on NetName \\NetName with error (Error).
#Event ID 9: Witness Client received error (ErrorCode) from Witness Server WitnessServerIP for NetName \\NetName.
#Event ID 10: Witness Client received resource notification NotificationType for NetName \\NetName from Witness Server WitnessServerIP.
#Event ID 11: Witness Client failed resource notification for NetName \\NetName with error (Error).
#Event ID 12: Witness Client received a request to move to a different file server node for NetName \\NetName from Witness Server WitnessServerIP.
#Event ID 13: Witness Client failed the move request for NetName \\NetName with error (Error).
#Event ID 14: Witness Client received unregister request for \\NetName\ShareName.
#Event ID 15: Witness Client successfully unregistered from Witness Server WitnessServerIP for NetName \\NetName.
#Event ID 16: Witness Client failed to unregister from Witness Server WitnessServerIP for NetName \\NetName with error (Error).
#Event ID 17: Witness Client is already registered with Witness Server WitnessServer for notification on NetName \\NetName and IP address IPAddress.
#Event ID 18: Witness Client is already registered with Witness Server WitnessServer for notification on \\NetName\ShareName and IP address IPAddress.
#Event ID 19: Witness Client received an IP notification for NetName \\NetName from Witness Server WitnessServerIP.
#Event ID 20: Witness Client received an IP notification for \\NetName\ShareName from Witness Server WitnessServerIP.
#Event ID 21: Witness Client failed the IP notification for NetName \\NetName with error (Error).
#Event ID 22: Witness Client failed the IP notification for \\NetName\ShareName with error (Error).
#Event ID 23: Witness Client received a share move request for \\NetName\ShareName from Witness Server WitnessServer.
#Event ID 24: Witness Client failed the share move request for \\NetName\ShareName with error (Error).
#Event ID 25: Witness Client failed to unregister for NetName \\NetName because it is currently not registered.
#Event ID 26: Witness Client failed to unregister for \\NetName\ShareName because it is currently not registered.
#Event ID 27: Witness Client selected WitnessServerIP as the Witness Server for \\NetName\ShareName.
#Event ID 28: Witness Client failed to find a Witness Server for \\NetName\ShareName with error (ErrorCode).
#Description
Witness Client failed to find a Witness Server for \\NetName\ShareName with error (ErrorCode). Retrying in (Sleep) seconds. This event may be suppressed for this resource for the next 12 hours if the condition persists.
Message #
Fields #
| Name | Description |
|---|---|
NetName UnicodeString | |
ShareName UnicodeString | |
ErrorCode UInt32 | |
Sleep UInt32 |
Event ID 29: Witness Client successfully registered with Witness Server WitnessServerIP for notification on \\NetName\ShareName with IP address FileServerIP.
#Event ID 30: Witness Client failed to register with Witness Server WitnessServerIP for notification on \\NetName\ShareName with error (Error).
#Event ID 31: Witness Client received error (ErrorCode) from Witness Server WitnessServerIP for \\NetName\ShareName.
#Event ID 32: Witness Client received resource notification NotificationType for \\NetName\ShareName from Witness Server WitnessServerIP.
#Event ID 33: Witness Client failed resource notification for \\NetName\ShareName with error (Error).
#Event ID 34: Witness Client received a request to move to a different file server node for \\NetName\ShareName from Witness Server WitnessServerIP.
#Event ID 35: Witness Client failed the move request for \\NetName\ShareName with error (Error).
#Event ID 36: Witness Client successfully unregistered from Witness Server WitnessServerIP for \\NetName\ShareName.
#Event ID 37: Witness Client failed to unregister from Witness Server WitnessServerIP for \\NetName\ShareName with error (Error).
#Event ID 38: Witness Client failed to unregister notification for NetName \\NetName with error (Error).
#Event ID 39: Witness Client failed to unregister notification for \\NetName\ShareName with error (Error).
#Event ID 40: Witness Client failed registration request for \\NetName\ShareName with error (ErrorCode).
#Event ID 41: Witness Client obtained the list of Witness Servers from IP address WitnessServerIP with error (Error).
#Event ID 42: Witness Client failed to connect to the witness server at IP address WitnessServerIP with error (Error).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 32254f6c-aa33-46f0-a5e3-1cbcc74bf683
Defined in wkssvc.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02