Microsoft-Windows-TerminalServices-TSFairShare-Events

Event	Title	Channel	Sample	Rule
2	Event ID 2	Operational, Debug	N	N
3	Event ID 3	Operational, Debug	N	N
4	Event ID 4	Operational, Analytic	N	N
5	Event ID 5	Operational, Analytic	N	N
6	Event ID 6	Operational, Debug	N	N
7	Event ID 7	Operational, Debug	N	N
8	Event ID 8	Operational, Analytic	N	N
9	Event ID 9	Operational, Analytic	N	N
10	Event ID 10	Operational, Analytic	N	N
256	Event ID 256	Operational	N	N
256	Remote Desktop Services Fair Share started.	System	Y	N
257	Event ID 257	Operational	N	N
257	Remote Desktop Services Fair Share stopped.	System	N	N
258	Event ID 258	Operational	N	N
258	Remote Desktop Services Disk Fair Share started.	System	N	N
259	Event ID 259	Operational	N	N
259	Remote Desktop Services Disk Fair Share stopped.	System	N	N
272	Event ID 272	Operational	N	N
272	Remote Desktop Services Disk Fair Share has detected excessive disk activity for …	System	N	N
273	Event ID 273	Operational	N	N
273	Remote Desktop Services Disk Fair Share detected that disk activity for session …	System	N	N

Event ID 2

Channel: Operational, Debug

Fields #

Name	Description
`message` AnsiString

Event ID 3

Channel: Operational, Debug

Fields #

Name	Description
`message` AnsiString

Event ID 4

Channel: Operational, Analytic

Fields #

Name	Description
`message` AnsiString

Event ID 5

Channel: Operational, Analytic

Fields #

Name	Description
`message` AnsiString

Event ID 6

Channel: Operational, Debug

Fields #

Name	Description
`message` AnsiString

Event ID 7

Channel: Operational, Debug

Fields #

Name	Description
`message` AnsiString

Event ID 8

Channel: Operational, Analytic

Fields #

Name	Description
`message` AnsiString

Event ID 9

Channel: Operational, Analytic

Fields #

Name	Description
`message` AnsiString

Event ID 10

Channel: Operational, Analytic

Fields #

Name	Description
`message` AnsiString

Event ID 256

Channel: Operational

Description

Remote Desktop Services Fair Share started.

Event ID 256: Remote Desktop Services Fair Share started.

Channel: System
Level: 4

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-TSFairShare-Events",
    "guid": "8D83AEC0-01DE-4772-A317-2093B6DC3BAB",
    "event_source_name": "",
    "event_id": 256,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-08-01T01:02:26.156851+00:00",
    "event_record_id": 102902,
    "correlation": {
      "ActivityID": "8D83AEC0-01DE-4772-A317-2093B6DC3BAB"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 1020
    },
    "channel": "System",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 257

Channel: Operational

Description

Remote Desktop Services Fair Share stopped.

Event ID 257: Remote Desktop Services Fair Share stopped.

Channel: System

Event ID 258

Channel: Operational

Description

Remote Desktop Services Disk Fair Share started.

Event ID 258: Remote Desktop Services Disk Fair Share started.

Channel: System

Event ID 259

Channel: Operational

Description

Remote Desktop Services Disk Fair Share stopped.

Event ID 259: Remote Desktop Services Disk Fair Share stopped.

Channel: System

Event ID 272

Channel: Operational

Description

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session . The session is in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 272: Remote Desktop Services Disk Fair Share has detected excessive disk activity for session Param1.

Channel: System

Description

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session Param1. The session is in restrain mode.

Message #

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session %1. The session is in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 273

Channel: Operational

Description

Remote Desktop Services Disk Fair Share detected that disk activity for session is back to normal. The session is no longer in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 273: Remote Desktop Services Disk Fair Share detected that disk activity for session Param1 is back to normal.

Channel: System

Description

Remote Desktop Services Disk Fair Share detected that disk activity for session Param1 is back to normal. The session is no longer in restrain mode.

Message #

Remote Desktop Services Disk Fair Share detected that disk activity for session %1 is back to normal. The session is no longer in restrain mode.

Fields #

Name	Description
`Param1` Int32