Microsoft-Windows-SmbWmiProvider

Event	Title	Channel	Sample	Rule
0	Function FunctionName returned MI error MiError Win32 Error Win32Error.	SmbWmiAnalytic	Y	N
1	Message.	SmbWmiAnalytic	N	N
2	Message.	SmbWmiAnalytic	Y	N

Event ID 0: Function FunctionName returned MI error MiError Win32 Error Win32Error.

Channel: SmbWmiAnalytic
Level: Error

Message #

Function %1 returned MI error %2 Win32 Error %3

Fields #

Name	Description
`FunctionName` UnicodeString
`MiError` UInt32
`Win32Error` UInt32

Example Event #

{
  "system": {
    "channel": "SmbWmiAnalytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6836,
      "thread_id": 11148
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SmbWmiProvider",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:18:20.382Z",
    "version": 0
  },
  "event_data": {
    "FunctionName": "ShareIndicationContext",
    "MiError": 21,
    "Win32Error": 0
  },
  "message": ""
}

Event ID 1: Message.

Channel: SmbWmiAnalytic

Message #

%1

Fields #

Name	Description
`Message` UnicodeString

Event ID 2: Message.

Channel: SmbWmiAnalytic
Level: Informational

Message #

%1

Fields #

Name	Description
`Message` UnicodeString

Example Event #

{
  "system": {
    "channel": "SmbWmiAnalytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6836,
      "thread_id": 11148
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-SmbWmiProvider",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:18:20.382Z",
    "version": 0
  },
  "event_data": {
    "Message": "Start MSFT_SmbShare_Invoke_FireShareChangeEvent"
  },
  "message": ""
}

Provenance

ETW provider GUID 50b9e206-9d55-4092-92e8-f157a8235799

Defined in SmbWmiv2.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3207, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.2161, captured 2026-06-02 — Manifest XML pack, 2.0 MB