detection.wiki

Microsoft-Windows-SMBWitnessClient

EventTitleChannelSampleRule
1Witness Client initialization failed with error (ErrorCode).AdminNN
2Witness Client received registration request for \\NetName\ShareName with IP …InformationalNN
3Witness Client failed to obtain the list of Witness Servers from IP address …AdminNN
4Witness Client is waiting to receive list of Witness Servers from IP address …InformationalNN
5Witness Client selected WitnessServerIP as the Witness Server for NetName …InformationalNN
6Witness Client failed to find a Witness Server for NetName \\NetName with error …AdminNN
7Witness Client successfully registered with Witness Server WitnessServerIP for …InformationalNN
8Witness Client failed to register with Witness Server WitnessServerIP for …AdminNN
9Witness Client received error (ErrorCode) from Witness Server WitnessServerIP …AdminNN
10Witness Client received resource notification NotificationType for NetName …AdminNN
11Witness Client failed resource notification for NetName \\NetName with error …AdminNN
12Witness Client received a request to move to a different file server node for …AdminNN
13Witness Client failed the move request for NetName \\NetName with error (Error).AdminNN
14Witness Client received unregister request for \\NetName\ShareName.InformationalNN
15Witness Client successfully unregistered from Witness Server WitnessServerIP for …InformationalNN
16Witness Client failed to unregister from Witness Server WitnessServerIP for …AdminNN
17Witness Client is already registered with Witness Server WitnessServer for …InformationalNN
18Witness Client is already registered with Witness Server WitnessServer for …InformationalNN
19Witness Client received an IP notification for NetName \\NetName from Witness …AdminNN
20Witness Client received an IP notification for \\NetName\ShareName from Witness …AdminNN
21Witness Client failed the IP notification for NetName \\NetName with error …AdminNN
22Witness Client failed the IP notification for \\NetName\ShareName with error …AdminNN
23Witness Client received a share move request for \\NetName\ShareName from …AdminNN
24Witness Client failed the share move request for \\NetName\ShareName with error …AdminNN
25Witness Client failed to unregister for NetName \\NetName because it is …AdminNN
26Witness Client failed to unregister for \\NetName\ShareName because it is …AdminNN
27Witness Client selected WitnessServerIP as the Witness Server for …InformationalNN
28Witness Client failed to find a Witness Server for \\NetName\ShareName with …AdminNN
29Witness Client successfully registered with Witness Server WitnessServerIP for …InformationalNN
30Witness Client failed to register with Witness Server WitnessServerIP for …AdminNN
31Witness Client received error (ErrorCode) from Witness Server WitnessServerIP …AdminNN
32Witness Client received resource notification NotificationType for …AdminNN
33Witness Client failed resource notification for \\NetName\ShareName with error …AdminNN
34Witness Client received a request to move to a different file server node for …AdminNN
35Witness Client failed the move request for \\NetName\ShareName with error …AdminNN
36Witness Client successfully unregistered from Witness Server WitnessServerIP for …InformationalNN
37Witness Client failed to unregister from Witness Server WitnessServerIP for …AdminNN
38Witness Client failed to unregister notification for NetName \\NetName with …AdminNN
39Witness Client failed to unregister notification for \\NetName\ShareName with …AdminNN
40Witness Client failed registration request for \\NetName\ShareName with error …AdminNN
41Witness Client obtained the list of Witness Servers from IP address …AdminNN
42Witness Client failed to connect to the witness server at IP address …AdminNN

Event ID 1: Witness Client initialization failed with error (ErrorCode).

#
Channel
Admin

Message #

Witness Client initialization failed with error (%1)

Fields #

NameDescription
ErrorCode UInt32

Event ID 2: Witness Client received registration request for \\NetName\ShareName with IP address WitnessServerIP.

#
Channel
Informational

Message #

Witness Client received registration request for \\%1\%2 with IP address %3

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
WitnessServerIP UnicodeString

Event ID 3: Witness Client failed to obtain the list of Witness Servers from IP address WitnessServerIP with error (Error).

#
Channel
Admin

Description

Witness Client failed to obtain the list of Witness Servers from IP address WitnessServerIP with error (Error). This event may be suppressed for this resource for the next 12 hours if the condition persists.

Message #

Witness Client failed to obtain the list of Witness Servers from IP address %1 with error (%2).  This event may be suppressed for this resource for the next 12 hours if the condition persists.

Fields #

NameDescription
WitnessServerIP UnicodeString
Error UInt32

Event ID 4: Witness Client is waiting to receive list of Witness Servers from IP address WitnessServerIP.

#
Channel
Informational

Message #

Witness Client is waiting to receive list of Witness Servers from IP address %1

Fields #

NameDescription
WitnessServerIP UnicodeString

Event ID 5: Witness Client selected WitnessServerIP as the Witness Server for NetName \\NetName.

#
Channel
Informational

Message #

Witness Client selected %1 as the Witness Server for NetName \\%2

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString

Event ID 6: Witness Client failed to find a Witness Server for NetName \\NetName with error (ErrorCode).

#
Channel
Admin

Description

Witness Client failed to find a Witness Server for NetName \\ with error (). Retrying in () seconds. This event may be suppressed for this resource for the next 12 hours if the condition persists.

Message #

Witness Client failed to find a Witness Server for NetName \\%1 with error (%2). Retrying in (%3) seconds. This event may be suppressed for this resource for the next 12 hours if the condition persists.

Fields #

NameDescription
NetName UnicodeString
ErrorCode UInt32
Sleep UInt32

Event ID 7: Witness Client successfully registered with Witness Server WitnessServerIP for notification on NetName \\NetName with IP address FileServerIP.

#
Channel
Informational

Message #

Witness Client successfully registered with Witness Server %1 for notification on NetName \\%2 with IP address %3

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
FileServerIP UnicodeString

Event ID 8: Witness Client failed to register with Witness Server WitnessServerIP for notification on NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to register with Witness Server %1 for notification on NetName \\%2 with error (%3)

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
Error UInt32

Event ID 9: Witness Client received error (ErrorCode) from Witness Server WitnessServerIP for NetName \\NetName.

#
Channel
Admin

Message #

Witness Client received error (%1) from Witness Server %2 for NetName \\%3

Fields #

NameDescription
ErrorCode UInt32
WitnessServerIP UnicodeString
NetName UnicodeString

Event ID 10: Witness Client received resource notification NotificationType for NetName \\NetName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received resource notification %1 for NetName \\%2 from Witness Server %3

Fields #

NameDescription
NotificationType UInt32
NetName UnicodeString
WitnessServerIP UnicodeString

Event ID 11: Witness Client failed resource notification for NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed resource notification for NetName \\%1 with error (%2)

Fields #

NameDescription
NetName UnicodeString
Error UInt32

Event ID 12: Witness Client received a request to move to a different file server node for NetName \\NetName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received a request to move to a different file server node for NetName \\%1 from Witness Server %2

Fields #

NameDescription
NetName UnicodeString
WitnessServerIP UnicodeString

Event ID 13: Witness Client failed the move request for NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed the move request for NetName \\%1 with error (%2)

Fields #

NameDescription
NetName UnicodeString
Error UInt32

Event ID 14: Witness Client received unregister request for \\NetName\ShareName.

#
Channel
Informational

Message #

Witness Client received unregister request for \\%1\%2

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString

Event ID 15: Witness Client successfully unregistered from Witness Server WitnessServerIP for NetName \\NetName.

#
Channel
Informational

Message #

Witness Client successfully unregistered from Witness Server %1 for NetName \\%2

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString

Event ID 16: Witness Client failed to unregister from Witness Server WitnessServerIP for NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to unregister from Witness Server %1 for NetName \\%2 with error (%3)

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
Error UInt32

Event ID 17: Witness Client is already registered with Witness Server WitnessServer for notification on NetName \\NetName and IP address IPAddress.

#
Channel
Informational

Message #

Witness Client is already registered with Witness Server %1 for notification on NetName \\%2 and IP address %3

Fields #

NameDescription
WitnessServer UnicodeString
NetName UnicodeString
IPAddress UnicodeString

Event ID 18: Witness Client is already registered with Witness Server WitnessServer for notification on \\NetName\ShareName and IP address IPAddress.

#
Channel
Informational

Message #

Witness Client is already registered with Witness Server %1 for notification on \\%2\%3 and IP address %4

Fields #

NameDescription
WitnessServer UnicodeString
NetName UnicodeString
ShareName UnicodeString
IPAddress UnicodeString

Event ID 19: Witness Client received an IP notification for NetName \\NetName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received an IP notification for NetName \\%1 from Witness Server %2

Fields #

NameDescription
NetName UnicodeString
WitnessServerIP UnicodeString

Event ID 20: Witness Client received an IP notification for \\NetName\ShareName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received an IP notification for \\%1\%2 from Witness Server %3

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
WitnessServerIP UnicodeString

Event ID 21: Witness Client failed the IP notification for NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed the IP notification for NetName \\%1 with error (%2)

Fields #

NameDescription
NetName UnicodeString
Error UInt32

Event ID 22: Witness Client failed the IP notification for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed the IP notification for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 23: Witness Client received a share move request for \\NetName\ShareName from Witness Server WitnessServer.

#
Channel
Admin

Message #

Witness Client received a share move request for \\%1\%2 from Witness Server %3

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
WitnessServer UnicodeString

Event ID 24: Witness Client failed the share move request for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed the share move request for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 25: Witness Client failed to unregister for NetName \\NetName because it is currently not registered.

#
Channel
Admin

Message #

Witness Client failed to unregister for NetName \\%1 because it is currently not registered

Fields #

NameDescription
NetName UnicodeString

Event ID 26: Witness Client failed to unregister for \\NetName\ShareName because it is currently not registered.

#
Channel
Admin

Message #

Witness Client failed to unregister for \\%1\%2 because it is currently not registered

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString

Event ID 27: Witness Client selected WitnessServerIP as the Witness Server for \\NetName\ShareName.

#
Channel
Informational

Message #

Witness Client selected %1 as the Witness Server for \\%2\%3

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString

Event ID 28: Witness Client failed to find a Witness Server for \\NetName\ShareName with error (ErrorCode).

#
Channel
Admin

Description

Witness Client failed to find a Witness Server for \\NetName\ShareName with error (ErrorCode). Retrying in (Sleep) seconds. This event may be suppressed for this resource for the next 12 hours if the condition persists.

Message #

Witness Client failed to find a Witness Server for \\%1\%2 with error (%3). Retrying in (%4) seconds. This event may be suppressed for this resource for the next 12 hours if the condition persists.

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
ErrorCode UInt32
Sleep UInt32

Event ID 29: Witness Client successfully registered with Witness Server WitnessServerIP for notification on \\NetName\ShareName with IP address FileServerIP.

#
Channel
Informational

Message #

Witness Client successfully registered with Witness Server %1 for notification on \\%2\%3 with IP address %4

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString
FileServerIP UnicodeString

Event ID 30: Witness Client failed to register with Witness Server WitnessServerIP for notification on \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to register with Witness Server %1 for notification on \\%2\%3 with error (%4)

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 31: Witness Client received error (ErrorCode) from Witness Server WitnessServerIP for \\NetName\ShareName.

#
Channel
Admin

Message #

Witness Client received error (%1) from Witness Server %2 for \\%3\%4

Fields #

NameDescription
ErrorCode UInt32
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString

Event ID 32: Witness Client received resource notification NotificationType for \\NetName\ShareName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received resource notification %1 for \\%2\%3 from Witness Server %4

Fields #

NameDescription
NotificationType UInt32
NetName UnicodeString
ShareName UnicodeString
WitnessServerIP UnicodeString

Event ID 33: Witness Client failed resource notification for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed resource notification for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 34: Witness Client received a request to move to a different file server node for \\NetName\ShareName from Witness Server WitnessServerIP.

#
Channel
Admin

Message #

Witness Client received a request to move to a different file server node for \\%1\%2 from Witness Server %3

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
WitnessServerIP UnicodeString

Event ID 35: Witness Client failed the move request for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed the move request for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 36: Witness Client successfully unregistered from Witness Server WitnessServerIP for \\NetName\ShareName.

#
Channel
Informational

Message #

Witness Client successfully unregistered from Witness Server %1 for \\%2\%3

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString

Event ID 37: Witness Client failed to unregister from Witness Server WitnessServerIP for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to unregister from Witness Server %1 for \\%2\%3 with error (%4)

Fields #

NameDescription
WitnessServerIP UnicodeString
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 38: Witness Client failed to unregister notification for NetName \\NetName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to unregister notification for NetName \\%1 with error (%2)

Fields #

NameDescription
NetName UnicodeString
Error UInt32

Event ID 39: Witness Client failed to unregister notification for \\NetName\ShareName with error (Error).

#
Channel
Admin

Message #

Witness Client failed to unregister notification for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
Error UInt32

Event ID 40: Witness Client failed registration request for \\NetName\ShareName with error (ErrorCode).

#
Channel
Admin

Message #

Witness Client failed registration request for \\%1\%2 with error (%3)

Fields #

NameDescription
NetName UnicodeString
ShareName UnicodeString
ErrorCode UInt32

Event ID 41: Witness Client obtained the list of Witness Servers from IP address WitnessServerIP with error (Error).

#
Channel
Admin

Message #

Witness Client obtained the list of Witness Servers from IP address %1 with error (%2)

Fields #

NameDescription
WitnessServerIP UnicodeString
Error UInt32

Event ID 42: Witness Client failed to connect to the witness server at IP address WitnessServerIP with error (Error).

#
Channel
Admin

Description

Witness Client failed to connect to the witness server at IP address WitnessServerIP with error (Error). This event may be suppressed for this resource for the next 12 hours if the condition persists.

Message #

Witness Client failed to connect to the witness server at IP address %1 with error (%2).  This event may be suppressed for this resource for the next 12 hours if the condition persists.

Fields #

NameDescription
WitnessServerIP UnicodeString
Error UInt32

Provenance

ETW provider GUID 32254f6c-aa33-46f0-a5e3-1cbcc74bf683

Defined in wkssvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB