Microsoft-Windows-StorageSpaces-Api

34 events across 1 channel

Event	Title	Channel	Sample
1	Failed to initialize Storage Spaces API.	Operational	N
3	Failed to clean up Storage Spaces API.	Operational	N
100	The pool was created successfully.	Operational	N
101	Failed to create the pool.	Operational	N
102	The pool was deleted successfully.	Operational	N
103	Failed to delete the pool.	Operational	N
105	Failed to refresh the pool.	Operational	N
200	The drive attributes were set successfully.	Operational	N
201	Failed to set drive attributes.	Operational	N
202	Maintenance was set on the drives successfully.	Operational	N
203	Failed to set maintenance on the drives.	Operational	N
204	Maintenance was set on the drive successfully.	Operational	N
205	Failed to set maintenance on the drive.	Operational	N
206	The drives were added successfully.	Operational	N
207	Failed to add the drives.	Operational	N
208	The drives were removed successfully.	Operational	N
209	Failed to remove the drives.	Operational	N
211	Failed to refresh the drive.	Operational	N
212	The drive was reset successfully.	Operational	N
213	Failed to reset the drive.	Operational	N
214	The drive was prepared successfully.	Operational	N
215	Failed to prepare the drive.	Operational	N
216	The drive was unprepared successfully.	Operational	N
217	Failed to unprepare the drive.	Operational	N
300	The space was created successfully.	Operational	N
301	Failed to create the space.	Operational	N
302	The space was deleted successfully.	Operational	N
303	Failed to delete the space.	Operational	N
304	The space was attached successfully.	Operational	N
305	Failed to attach the space.	Operational	N
306	The space was detached successfully.	Operational	N
307	Failed to detach the space.	Operational	N
308	Conversion to space completed successfully.	Operational	N
309	Conversion to space failed.	Operational	N

Event ID 1: Failed to initialize Storage Spaces API.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to initialize Storage Spaces API.

Message #

Failed to initialize Storage Spaces API.                    
Module: %1                    
Function: %2                    
Callee: %3                    
Error: %4

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Callee` AnsiString
`Error` UInt32

Event ID 3: Failed to clean up Storage Spaces API.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to clean up Storage Spaces API.

Message #

Failed to clean up Storage Spaces API.                    
Module: %1                    
Function: %2                    
Callee: %3                    
Error: %4

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Callee` AnsiString
`Error` UInt32

Event ID 100: The pool was created successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The pool was created successfully.

Message #

The pool was created successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Name: %4                    
Compatible Version: %5                    
Drive Ids: %6                    
Duration: %7 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Name` UnicodeString
`CompatibleVersion` UInt32
`DriveIds` UnicodeString
`DurationInUs` UInt64

Event ID 101: Failed to create the pool.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to create the pool.

Message #

Failed to create the pool.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Name: %4                    
Compatible Version: %5                    
Drive Ids: %6                    
Callee: %7                    
Error: %8

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Name` UnicodeString
`CompatibleVersion` UInt32
`DriveIds` UnicodeString
`Callee` AnsiString
`Error` UInt32

Event ID 102: The pool was deleted successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The pool was deleted successfully.

Message #

The pool was deleted successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Duration: %4 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`DurationInUs` UInt64

Event ID 103: Failed to delete the pool.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to delete the pool.

Message #

Failed to delete the pool.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 105: Failed to refresh the pool.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to refresh the pool.

Message #

Failed to refresh the pool.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 200: The drive attributes were set successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drive attributes were set successfully.

Message #

The drive attributes were set successfully.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Persist: %4                    
Relinquish Ownership: %5                    
Attributes: %6                    
Attributes Mask: %7                    
Owner: %8                    
Duration: %9 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`DriveId` GUID
`Persist` Boolean
`RelinquishOwnership` Boolean
`Attributes` UInt64
`AttributesMask` UInt64
`Owner` GUID
`DurationInUs` UInt64

Event ID 201: Failed to set drive attributes.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to set drive attributes.

Message #

Failed to set drive attributes.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Persist: %4                    
Relinquish Ownership: %5                    
Attributes: %6                    
Attributes Mask: %7                    
Owner: %8                    
Callee: %9                    
Error: %10

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`DriveId` GUID
`Persist` Boolean
`RelinquishOwnership` Boolean
`Attributes` UInt64
`AttributesMask` UInt64
`Owner` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 202: Maintenance was set on the drives successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Maintenance was set on the drives successfully.

Message #

Maintenance was set on the drives successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Enable: %4                    
Timeout: %5 s                    
Drive Ids: %6                    
Duration: %7 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Enable` Boolean
`TimeoutInSeconds` UInt32
`DriveIds` UnicodeString
`DurationInUs` UInt64

Event ID 203: Failed to set maintenance on the drives.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to set maintenance on the drives.

Message #

Failed to set maintenance on the drives.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Enable: %4                    
Timeout: %5 s                    
Drive Ids: %6                    
Callee: %7                    
Error: %8

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Enable` Boolean
`TimeoutInSeconds` UInt32
`DriveIds` UnicodeString
`Callee` AnsiString
`Error` UInt32

Event ID 204: Maintenance was set on the drive successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Maintenance was set on the drive successfully.

Message #

Maintenance was set on the drive successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Enable: %4                    
Timeout: %5 s                    
Drive Id: %6                    
Duration: %7 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Enable` Boolean
`TimeoutInSeconds` UInt32
`DriveId` GUID
`DurationInUs` UInt64

Event ID 205: Failed to set maintenance on the drive.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to set maintenance on the drive.

Message #

Failed to set maintenance on the drive.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Enable: %4                    
Timeout: %5 s                    
Drive Id: %6                    
Callee: %7                    
Error: %8

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`Enable` Boolean
`TimeoutInSeconds` UInt32
`DriveId` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 206: The drives were added successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drives were added successfully.

Message #

The drives were added successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Drive Ids: %4                    
Duration: %5 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`DriveIds` UnicodeString
`DurationInUs` UInt64

Event ID 207: Failed to add the drives.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to add the drives.

Message #

Failed to add the drives.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Drive Ids: %4                    
Callee: %5                    
Error: %6

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`DriveIds` UnicodeString
`Callee` AnsiString
`Error` UInt32

Event ID 208: The drives were removed successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drives were removed successfully.

Message #

The drives were removed successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Drive Ids: %4                    
Duration: %5 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`DriveIds` UnicodeString
`DurationInUs` UInt64

Event ID 209: Failed to remove the drives.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to remove the drives.

Message #

Failed to remove the drives.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Drive Ids: %4                    
Callee: %5                    
Error: %6

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`DriveIds` UnicodeString
`Callee` AnsiString
`Error` UInt32

Event ID 211: Failed to refresh the drive.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to refresh the drive.

Message #

Failed to refresh the drive.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 212: The drive was reset successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drive was reset successfully.

Message #

The drive was reset successfully.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Duration: %4 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`DurationInUs` UInt64

Event ID 213: Failed to reset the drive.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to reset the drive.

Message #

Failed to reset the drive.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 214: The drive was prepared successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drive was prepared successfully.

Message #

The drive was prepared successfully.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Duration: %4 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`DurationInUs` UInt64

Event ID 215: Failed to prepare the drive.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to prepare the drive.

Message #

Failed to prepare the drive.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 216: The drive was unprepared successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The drive was unprepared successfully.

Message #

The drive was unprepared successfully.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Duration: %4 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`DurationInUs` UInt64

Event ID 217: Failed to unprepare the drive.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to unprepare the drive.

Message #

Failed to unprepare the drive.                    
Module: %1                    
Function: %2                    
Drive Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 300: The space was created successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The space was created successfully.

Message #

The space was created successfully.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Space Id: %4                    
Name: %5                    
Usage: %6                    
Duration: %7 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`SpaceId` GUID
`Name` UnicodeString
`Usage` UInt32
`DurationInUs` UInt64

Event ID 301: Failed to create the space.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to create the space.

Message #

Failed to create the space.                    
Module: %1                    
Function: %2                    
Pool Id: %3                    
Space Id: %4                    
Name: %5                    
Usage: %6                    
Callee: %7                    
Error: %8

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`PoolId` GUID
`SpaceId` GUID
`Name` UnicodeString
`Usage` UInt32
`Callee` AnsiString
`Error` UInt32

Event ID 302: The space was deleted successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The space was deleted successfully.

Message #

The space was deleted successfully.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Duration: %4 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`DurationInUs` UInt64

Event ID 303: Failed to delete the space.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to delete the space.

Message #

Failed to delete the space.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Callee: %4                    
Error: %5

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`Id` GUID
`Callee` AnsiString
`Error` UInt32

Event ID 304: The space was attached successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The space was attached successfully.

Message #

The space was attached successfully.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Owner Id: %4                    
Hidden: %5                    
Duration: %6 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`Owner` GUID
`Hidden` Boolean
`DurationInUs` UInt64

Event ID 305: Failed to attach the space.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to attach the space.

Message #

Failed to attach the space.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Owner Id: %4                    
Hidden: %5                    
Callee: %6                    
Error: %7

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`Owner` GUID
`Hidden` Boolean
`Callee` AnsiString
`Error` UInt32

Event ID 306: The space was detached successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

The space was detached successfully.

Message #

The space was detached successfully.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Owner Id: %4                    
Hidden: %5                    
Duration: %6 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`Owner` GUID
`Hidden` Boolean
`DurationInUs` UInt64

Event ID 307: Failed to detach the space.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Failed to detach the space.

Message #

Failed to detach the space.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Owner Id: %4                    
Hidden: %5                    
Callee: %6                    
Error: %7

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`Owner` GUID
`Hidden` Boolean
`Callee` AnsiString
`Error` UInt32

Event ID 308: Conversion to space completed successfully.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Conversion to space completed successfully.

Message #

Conversion to space completed successfully.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Device Number: %4                    
Device Id: %5                    
FirstDataIndex: %6                    
DataLength: %7                    
Duration: %8 us

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`DeviceNumber` UInt32
`DeviceId` GUID
`FirstDataIndex` UInt32
`DataLength` UInt64
`DurationInUs` UInt64

Event ID 309: Conversion to space failed.

Provider: Microsoft-Windows-StorageSpaces-Api
Channel: Operational

Description

Conversion to space failed.

Message #

Conversion to space failed.                    
Module: %1                    
Function: %2                    
Space Id: %3                    
Device Number: %4                    
Device Id: %5                    
FirstDataIndex: %6                    
DataLength: %7                    
Callee: %8                    
Error: %9

Fields #

Name	Description
`Module` UnicodeString
`Function` AnsiString
`SpaceId` GUID
`DeviceNumber` UInt32
`DeviceId` GUID
`FirstDataIndex` UInt32
`DataLength` UInt64
`Callee` AnsiString
`Error` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID bcf0c6a7-6130-5208-f27d-fa77a91f12df

Defined in spaceport.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4163, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)