Microsoft-Windows-SMBWitnessService

Event	Title	Channel	Sample	Rule
1	Witness Service initialization failed with ErrorCode.	Admin	N	N
1	Event ID 1	Operational	N	N
2	Witness Service protocol security callback failure (Error = ErrorCode, …	Admin	N	N
2	Event ID 2	Operational	N	N
3	Witness Service received a registration request from Witness Client (ClientName) …	Admin	N	N
3	Event ID 3	Operational	N	N
4	Witness Service successfully registered request from Witness Client (ClientName) …	Admin	N	N
4	Event ID 4	Operational	N	N
5	Witness Service registration request from Witness Client (ClientName) for …	Admin	N	N
5	Event ID 5	Operational	N	N
6	Witness Service is queuing notifications for Clients clients.	Admin	N	N
6	Event ID 6	Operational	N	N
7	Witness Service completed queuing notifications for Clients clients.	Admin	N	N
7	Event ID 7	Operational	N	N
8	Witness Service resource notification to Witness Client (ClientName) failed with …	Admin	N	N
8	Event ID 8	Operational	N	N
9	Witness Service sent NumResources resource events to Witness Client …	Admin	N	N
9	Event ID 9	Operational	N	N
10	Witness Service received a move client request for client (ClientName).	Admin	N	N
10	Event ID 10	Operational	N	N
11	Witness Service successfully sent a move request to client (ClientName).	Admin	N	N
11	Event ID 11	Operational	N	N
12	Witness Service ignored the move client request for client (ClientName).	Admin	N	N
12	Event ID 12	Operational	N	N
13	Witness Service ignored the move client request for client (ClientName).	Admin	N	N
13	Event ID 13	Operational	N	N
14	Witness Service reported a failure (ErrorCode) to move client (ClientName).	Admin	N	N
14	Event ID 14	Operational	N	N
15	Witness Service received witness unregister request from Witness Client …	Admin	N	N
15	Event ID 15	Operational	N	N
16	Witness Service removed registration for Witness Client (ClientName).	Admin	N	N
16	Event ID 16	Operational	N	N
17	Witness Service shutdown failed with error (ErrorCode).	Admin	N	N
17	Event ID 17	Operational	N	N
18	Witness Service successfully sent the list of Witness Servers to Client …	Admin	N	N
18	Event ID 18	Operational	N	N
19	Witness Service is retrying to process the list of Witness Servers to Client …	Admin	N	N
19	Event ID 19	Operational	N	N
20	Witness Service failed to process the list of Witness Servers for Client …	Admin	N	N
20	Event ID 20	Operational	N	N
21	Witness Service failed to move client (ClientName).	Admin	N	N
21	Event ID 21	Operational	N	N
22	Witness Service failed to move client (ClientName).	Admin	N	N
22	Event ID 22	Operational	N	N
23	Witness Service failed to move client (ClientName) to destination node …	Admin	N	N
23	Event ID 23	Operational	N	N
24	Witness Service received a registration request from Witness Client (ClientName) …	Admin	N	N
24	Event ID 24	Operational	N	N
25	Witness Service successfully registered request from Witness Client (ClientName) …	Admin	N	N
25	Event ID 25	Operational	N	N
26	Witness Service registration request from Witness Client (ClientName) for …	Admin	N	N
26	Event ID 26	Operational	N	N
27	Witness Service received witness unregister request from Witness Client …	Admin	N	N
27	Event ID 27	Operational	N	N
28	Witness Service is queuing share move notifications for Clients clients.	Admin	N	N
28	Event ID 28	Operational	N	N
29	Witness Service completed queuing share move notifications for Clients clients.	Admin	N	N
29	Event ID 29	Operational	N	N
30	Witness Service share move notification to Witness Client (ClientName) failed …	Admin	N	N
30	Event ID 30	Operational	N	N
31	Witness Service sent NumResources share move events to Witness Client …	Admin	N	N
31	Event ID 31	Operational	N	N
32	Witness Service is queuing IP notifications for Clients clients.	Admin	N	N
32	Event ID 32	Operational	N	N
33	Witness Service completed queuing IP notifications for Clients clients.	Admin	N	N
33	Event ID 33	Operational	N	N
34	Witness Service IP notification to Witness Client (ClientName) failed with error …	Admin	N	N
34	Event ID 34	Operational	N	N
35	Witness Service sent NumResources IP events to Witness Client (ClientName).	Admin	N	N
35	Event ID 35	Operational	N	N
36	Witness Service is requesting to move an SMB client that is optimized to connect …	Admin	N	N
36	Event ID 36	Operational	N	N

Event ID 1: Witness Service initialization failed with ErrorCode.

Channel: Admin

Message #

Witness Service initialization failed with %1

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1

Channel: Operational

Description

Witness Service initialization failed with.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 2: Witness Service protocol security callback failure (Error = ErrorCode, Authentication Level = AuthenticationLevel, Authentication Service = AuthenticationService).

Channel: Admin

Message #

Witness Service protocol security callback failure (Error = %3, Authentication Level = %1, Authentication Service = %2)

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 2

Channel: Operational

Description

Witness Service protocol security callback failure (Error = , Authentication Level = , Authentication Service = ).

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 3: Witness Service received a registration request from Witness Client (ClientName) for NetName \\NetName.

Channel: Admin

Message #

Witness Service received a registration request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 3

Channel: Operational

Description

Witness Service received a registration request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4: Witness Service successfully registered request from Witness Client (ClientName) for NetName \\NetName.

Channel: Admin

Message #

Witness Service successfully registered request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4

Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 5: Witness Service registration request from Witness Client (ClientName) for NetName \\NetName failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service registration request from Witness Client (%1) for NetName \\%2 failed with error (%3)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 5

Channel: Operational

Description

Witness Service registration request from Witness Client () for NetName \\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 6: Witness Service is queuing notifications for Clients clients.

Channel: Admin

Message #

Witness Service is queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 6

Channel: Operational

Description

Witness Service is queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 7: Witness Service completed queuing notifications for Clients clients.

Channel: Admin

Message #

Witness Service completed queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 7

Channel: Operational

Description

Witness Service completed queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 8: Witness Service resource notification to Witness Client (ClientName) failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service resource notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 8

Channel: Operational

Description

Witness Service resource notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 9: Witness Service sent NumResources resource events to Witness Client (ClientName).

Channel: Admin

Message #

Witness Service sent %1 resource events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 9

Channel: Operational

Description

Witness Service sent resource events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 10: Witness Service received a move client request for client (ClientName).

Channel: Admin

Message #

Witness Service received a move client request for client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 10

Channel: Operational

Description

Witness Service received a move client request for client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11: Witness Service successfully sent a move request to client (ClientName).

Channel: Admin

Message #

Witness Service successfully sent a move request to client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11

Channel: Operational

Description

Witness Service successfully sent a move request to client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12: Witness Service ignored the move client request for client (ClientName).

Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Client is not registered with current Witness Service.

Message #

Witness Service ignored the move client request for client (%1). Client is not registered with current Witness Service

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12

Channel: Operational

Description

Witness Service ignored the move client request for client (). Client is not registered with current Witness Service.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 13: Witness Service ignored the move client request for client (ClientName).

Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Destination server (ServerName) is unavailable.

Message #

Witness Service ignored the move client request for client (%1). Destination server (%2) is unavailable

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 13

Channel: Operational

Description

Witness Service ignored the move client request for client (). Destination server () is unavailable.

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 14: Witness Service reported a failure (ErrorCode) to move client (ClientName).

Channel: Admin

Message #

Witness Service reported a failure (%1) to move client (%2)

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 14

Channel: Operational

Description

Witness Service reported a failure () to move client ().

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 15: Witness Service received witness unregister request from Witness Client (ClientName) for NetName \\NetName.

Channel: Admin

Message #

Witness Service received witness unregister request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 15

Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 16: Witness Service removed registration for Witness Client (ClientName).

Channel: Admin

Message #

Witness Service removed registration for Witness Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 16

Channel: Operational

Description

Witness Service removed registration for Witness Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 17: Witness Service shutdown failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service shutdown failed with error (%1)

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 17

Channel: Operational

Description

Witness Service shutdown failed with error ().

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 18: Witness Service successfully sent the list of Witness Servers to Client (ClientName).

Channel: Admin

Message #

Witness Service successfully sent the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 18

Channel: Operational

Description

Witness Service successfully sent the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19: Witness Service is retrying to process the list of Witness Servers to Client (ClientName).

Channel: Admin

Message #

Witness Service is retrying to process the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19

Channel: Operational

Description

Witness Service is retrying to process the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 20: Witness Service failed to process the list of Witness Servers for Client (ClientName) with error (ErrorCode).

Channel: Admin

Message #

Witness Service failed to process the list of Witness Servers for Client (%1) with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 20

Channel: Operational

Description

Witness Service failed to process the list of Witness Servers for Client () with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 21: Witness Service failed to move client (ClientName).

Channel: Admin

Description

Witness Service failed to move client (ClientName). Client name is invalid.

Message #

Witness Service failed to move client (%1). Client name is invalid

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 21

Channel: Operational

Description

Witness Service failed to move client (). Client name is invalid.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 22: Witness Service failed to move client (ClientName).

Channel: Admin

Description

Witness Service failed to move client (ClientName). Destination node (DestinationNode) is invalid.

Message #

Witness Service failed to move client (%1). Destination node (%2) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 22

Channel: Operational

Description

Witness Service failed to move client (). Destination node () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 23: Witness Service failed to move client (ClientName) to destination node (DestinationNode).

Channel: Admin

Description

Witness Service failed to move client (ClientName) to destination node (DestinationNode). NetName (NetName) is invalid.

Message #

Witness Service failed to move client (%1) to destination node (%2). NetName (%3) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 23

Channel: Operational

Description

Witness Service failed to move client () to destination node (). NetName () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 24: Witness Service received a registration request from Witness Client (ClientName) for \\NetName\ShareName.

Channel: Admin

Message #

Witness Service received a registration request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 24

Channel: Operational

Description

Witness Service received a registration request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25: Witness Service successfully registered request from Witness Client (ClientName) for \\NetName\ShareName.

Channel: Admin

Message #

Witness Service successfully registered request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25

Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 26: Witness Service registration request from Witness Client (ClientName) for \\NetName\ShareName failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service registration request from Witness Client (%1) for \\%2\%3 failed with error (%4)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 26

Channel: Operational

Description

Witness Service registration request from Witness Client () for \\\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 27: Witness Service received witness unregister request from Witness Client (ClientName) for \\NetName\ShareName.

Channel: Admin

Message #

Witness Service received witness unregister request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 27

Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 28: Witness Service is queuing share move notifications for Clients clients.

Channel: Admin

Message #

Witness Service is queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 28

Channel: Operational

Description

Witness Service is queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 29: Witness Service completed queuing share move notifications for Clients clients.

Channel: Admin

Message #

Witness Service completed queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 29

Channel: Operational

Description

Witness Service completed queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 30: Witness Service share move notification to Witness Client (ClientName) failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service share move notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 30

Channel: Operational

Description

Witness Service share move notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 31: Witness Service sent NumResources share move events to Witness Client (ClientName).

Channel: Admin

Message #

Witness Service sent %1 share move events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 31

Channel: Operational

Description

Witness Service sent share move events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 32: Witness Service is queuing IP notifications for Clients clients.

Channel: Admin

Message #

Witness Service is queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 32

Channel: Operational

Description

Witness Service is queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 33: Witness Service completed queuing IP notifications for Clients clients.

Channel: Admin

Message #

Witness Service completed queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 33

Channel: Operational

Description

Witness Service completed queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 34: Witness Service IP notification to Witness Client (ClientName) failed with error (ErrorCode).

Channel: Admin

Message #

Witness Service IP notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 34

Channel: Operational

Description

Witness Service IP notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 35: Witness Service sent NumResources IP events to Witness Client (ClientName).

Channel: Admin

Message #

Witness Service sent %1 IP events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 35

Channel: Operational

Description

Witness Service sent IP events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 36: Witness Service is requesting to move an SMB client that is optimized to connect to a specific SMB server for one or more file shares.

Channel: Admin

Message #

Witness Service is requesting to move an SMB client (%1) that is optimized to connect to a specific SMB server for one or more file shares. After requested move completes, the SMB client will attempt to move to the optimal SMB server for (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Event ID 36

Channel: Operational

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Provenance

ETW provider GUID ce704b50-b105-4bc8-a24f-1792c0401c2a

Defined in Witness.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB