Microsoft-Windows-SMBWitnessService

72 events across 2 channels

Event	Title	Channel	Sample
1	Witness Service initialization failed with ErrorCode.	Admin	N
1	Event ID 1	Operational	N
2	Witness Service protocol security callback failure (Error = ErrorCode, …	Admin	N
2	Event ID 2	Operational	N
3	Witness Service received a registration request from Witness Client (ClientName) …	Admin	N
3	Event ID 3	Operational	N
4	Witness Service successfully registered request from Witness Client (ClientName) …	Admin	N
4	Event ID 4	Operational	N
5	Witness Service registration request from Witness Client (ClientName) for …	Admin	N
5	Event ID 5	Operational	N
6	Witness Service is queuing notifications for Clients clients.	Admin	N
6	Event ID 6	Operational	N
7	Witness Service completed queuing notifications for Clients clients.	Admin	N
7	Event ID 7	Operational	N
8	Witness Service resource notification to Witness Client (ClientName) failed with …	Admin	N
8	Event ID 8	Operational	N
9	Witness Service sent NumResources resource events to Witness Client …	Admin	N
9	Event ID 9	Operational	N
10	Witness Service received a move client request for client (ClientName).	Admin	N
10	Event ID 10	Operational	N
11	Witness Service successfully sent a move request to client (ClientName).	Admin	N
11	Event ID 11	Operational	N
12	Witness Service ignored the move client request for client (ClientName).	Admin	N
12	Event ID 12	Operational	N
13	Witness Service ignored the move client request for client (ClientName).	Admin	N
13	Event ID 13	Operational	N
14	Witness Service reported a failure (ErrorCode) to move client (ClientName).	Admin	N
14	Event ID 14	Operational	N
15	Witness Service received witness unregister request from Witness Client …	Admin	N
15	Event ID 15	Operational	N
16	Witness Service removed registration for Witness Client (ClientName).	Admin	N
16	Event ID 16	Operational	N
17	Witness Service shutdown failed with error (ErrorCode).	Admin	N
17	Event ID 17	Operational	N
18	Witness Service successfully sent the list of Witness Servers to Client …	Admin	N
18	Event ID 18	Operational	N
19	Witness Service is retrying to process the list of Witness Servers to Client …	Admin	N
19	Event ID 19	Operational	N
20	Witness Service failed to process the list of Witness Servers for Client …	Admin	N
20	Event ID 20	Operational	N
21	Witness Service failed to move client (ClientName).	Admin	N
21	Event ID 21	Operational	N
22	Witness Service failed to move client (ClientName).	Admin	N
22	Event ID 22	Operational	N
23	Witness Service failed to move client (ClientName) to destination node …	Admin	N
23	Event ID 23	Operational	N
24	Witness Service received a registration request from Witness Client (ClientName) …	Admin	N
24	Event ID 24	Operational	N
25	Witness Service successfully registered request from Witness Client (ClientName) …	Admin	N
25	Event ID 25	Operational	N
26	Witness Service registration request from Witness Client (ClientName) for …	Admin	N
26	Event ID 26	Operational	N
27	Witness Service received witness unregister request from Witness Client …	Admin	N
27	Event ID 27	Operational	N
28	Witness Service is queuing share move notifications for Clients clients.	Admin	N
28	Event ID 28	Operational	N
29	Witness Service completed queuing share move notifications for Clients clients.	Admin	N
29	Event ID 29	Operational	N
30	Witness Service share move notification to Witness Client (ClientName) failed …	Admin	N
30	Event ID 30	Operational	N
31	Witness Service sent NumResources share move events to Witness Client …	Admin	N
31	Event ID 31	Operational	N
32	Witness Service is queuing IP notifications for Clients clients.	Admin	N
32	Event ID 32	Operational	N
33	Witness Service completed queuing IP notifications for Clients clients.	Admin	N
33	Event ID 33	Operational	N
34	Witness Service IP notification to Witness Client (ClientName) failed with error …	Admin	N
34	Event ID 34	Operational	N
35	Witness Service sent NumResources IP events to Witness Client (ClientName).	Admin	N
35	Event ID 35	Operational	N
36	Witness Service is requesting to move an SMB client that is optimized to connect …	Admin	N
36	Event ID 36	Operational	N

Event ID 1: Witness Service initialization failed with ErrorCode.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service initialization failed with ErrorCode.

Message #

Witness Service initialization failed with %1

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service initialization failed with.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 2: Witness Service protocol security callback failure (Error = ErrorCode, Authentication Level = AuthenticationLevel, Authentication Service = AuthenticationService).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service protocol security callback failure (Error = ErrorCode, Authentication Level = AuthenticationLevel, Authentication Service = AuthenticationService).

Message #

Witness Service protocol security callback failure (Error = %3, Authentication Level = %1, Authentication Service = %2)

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 2

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service protocol security callback failure (Error = , Authentication Level = , Authentication Service = ).

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 3: Witness Service received a registration request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a registration request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service received a registration request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 3

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a registration request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4: Witness Service successfully registered request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully registered request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service successfully registered request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 5: Witness Service registration request from Witness Client (ClientName) for NetName \\NetName failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service registration request from Witness Client (ClientName) for NetName \\NetName failed with error (ErrorCode).

Message #

Witness Service registration request from Witness Client (%1) for NetName \\%2 failed with error (%3)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 5

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service registration request from Witness Client () for NetName \\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 6: Witness Service is queuing notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing notifications for Clients clients.

Message #

Witness Service is queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 6

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 7: Witness Service completed queuing notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing notifications for Clients clients.

Message #

Witness Service completed queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 7

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 8: Witness Service resource notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service resource notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service resource notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 8

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service resource notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 9: Witness Service sent NumResources resource events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources resource events to Witness Client (ClientName).

Message #

Witness Service sent %1 resource events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 9

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent resource events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 10: Witness Service received a move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a move client request for client (ClientName).

Message #

Witness Service received a move client request for client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 10

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a move client request for client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11: Witness Service successfully sent a move request to client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully sent a move request to client (ClientName).

Message #

Witness Service successfully sent a move request to client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully sent a move request to client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12: Witness Service ignored the move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Client is not registered with current Witness Service.

Message #

Witness Service ignored the move client request for client (%1). Client is not registered with current Witness Service

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service ignored the move client request for client (). Client is not registered with current Witness Service.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 13: Witness Service ignored the move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Destination server (ServerName) is unavailable.

Message #

Witness Service ignored the move client request for client (%1). Destination server (%2) is unavailable

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 13

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service ignored the move client request for client (). Destination server () is unavailable.

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 14: Witness Service reported a failure (ErrorCode) to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service reported a failure (ErrorCode) to move client (ClientName).

Message #

Witness Service reported a failure (%1) to move client (%2)

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 14

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service reported a failure () to move client ().

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 15: Witness Service received witness unregister request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received witness unregister request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service received witness unregister request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 15

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 16: Witness Service removed registration for Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service removed registration for Witness Client (ClientName).

Message #

Witness Service removed registration for Witness Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 16

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service removed registration for Witness Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 17: Witness Service shutdown failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service shutdown failed with error (ErrorCode).

Message #

Witness Service shutdown failed with error (%1)

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 17

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service shutdown failed with error ().

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 18: Witness Service successfully sent the list of Witness Servers to Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully sent the list of Witness Servers to Client (ClientName).

Message #

Witness Service successfully sent the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 18

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully sent the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19: Witness Service is retrying to process the list of Witness Servers to Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is retrying to process the list of Witness Servers to Client (ClientName).

Message #

Witness Service is retrying to process the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is retrying to process the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 20: Witness Service failed to process the list of Witness Servers for Client (ClientName) with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to process the list of Witness Servers for Client (ClientName) with error (ErrorCode).

Message #

Witness Service failed to process the list of Witness Servers for Client (%1) with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 20

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to process the list of Witness Servers for Client () with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 21: Witness Service failed to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName). Client name is invalid.

Message #

Witness Service failed to move client (%1). Client name is invalid

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 21

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client (). Client name is invalid.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 22: Witness Service failed to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName). Destination node (DestinationNode) is invalid.

Message #

Witness Service failed to move client (%1). Destination node (%2) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 22

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client (). Destination node () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 23: Witness Service failed to move client (ClientName) to destination node (DestinationNode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName) to destination node (DestinationNode). NetName (NetName) is invalid.

Message #

Witness Service failed to move client (%1) to destination node (%2). NetName (%3) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 23

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client () to destination node (). NetName () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 24: Witness Service received a registration request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a registration request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service received a registration request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 24

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a registration request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25: Witness Service successfully registered request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully registered request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service successfully registered request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 26: Witness Service registration request from Witness Client (ClientName) for \\NetName\ShareName failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service registration request from Witness Client (ClientName) for \\NetName\ShareName failed with error (ErrorCode).

Message #

Witness Service registration request from Witness Client (%1) for \\%2\%3 failed with error (%4)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 26

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service registration request from Witness Client () for \\\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 27: Witness Service received witness unregister request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received witness unregister request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service received witness unregister request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 27

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 28: Witness Service is queuing share move notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing share move notifications for Clients clients.

Message #

Witness Service is queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 28

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 29: Witness Service completed queuing share move notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing share move notifications for Clients clients.

Message #

Witness Service completed queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 29

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 30: Witness Service share move notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service share move notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service share move notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 30

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service share move notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 31: Witness Service sent NumResources share move events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources share move events to Witness Client (ClientName).

Message #

Witness Service sent %1 share move events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 31

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent share move events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 32: Witness Service is queuing IP notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing IP notifications for Clients clients.

Message #

Witness Service is queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 32

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 33: Witness Service completed queuing IP notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing IP notifications for Clients clients.

Message #

Witness Service completed queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 33

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 34: Witness Service IP notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service IP notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service IP notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 34

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service IP notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 35: Witness Service sent NumResources IP events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources IP events to Witness Client (ClientName).

Message #

Witness Service sent %1 IP events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 35

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent IP events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 36: Witness Service is requesting to move an SMB client that is optimized to connect to a specific SMB server for one or more file shares.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Message #

Witness Service is requesting to move an SMB client (%1) that is optimized to connect to a specific SMB server for one or more file shares. After requested move completes, the SMB client will attempt to move to the optimal SMB server for (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Event ID 36

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID ce704b50-b105-4bc8-a24f-1792c0401c2a

Defined in Witness.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-SMBWitnessService registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)