detection.wiki

WdsImgSrv

EventTitleChannelSampleRule
1WdsImgSrvUnknownNN
17170688The Windows Deployment Services image server initialized successfully.UnknownNN
17170689The Windows Deployment Services image server shutdown successfully.UnknownNN
17170699The Windows Deployment Services image server refreshed settings successfully.UnknownNN
17170701The Windows Deployment Services image server refreshed Image Cache successfully.UnknownNN
2164654350Unattend file request was made over an insecure connection.UnknownNN
3238396162An error occurred while trying to initialize the Windows Deployment Services …UnknownNN
3238396163An error occurred while trying to shutdown the Windows Deployment Services image …UnknownNN
3238396164An error occurred while processing an image enumeration request.UnknownNN
3238396165An error occurred while processing a client unattend request.UnknownNN
3238396166An error occurred while processing an unattended variables request.UnknownNN
3238396167An error occurred while processing an initialize logging request.UnknownNN
3238396168An error occurred while processing a log message request.UnknownNN
3238396169An error occurred while processing a domain join information request.UnknownNN
3238396170An error occurred while refreshing settings.UnknownNN
3238396172An error occurred while refreshing Image Cache.UnknownNN
3238396175This system is using insecure settings for Windows Deployment Services.UnknownNN

Event ID 1: WdsImgSrv

#
Channel
Unknown

Event ID 17170688: The Windows Deployment Services image server initialized successfully.

#
Channel
Unknown

Event ID 17170689: The Windows Deployment Services image server shutdown successfully.

#
Channel
Unknown

Event ID 17170699: The Windows Deployment Services image server refreshed settings successfully.

#
Channel
Unknown

Event ID 17170701: The Windows Deployment Services image server refreshed Image Cache successfully.

#
Channel
Unknown

Description

The Windows Deployment Services image server refreshed Image Cache successfully. The Windows Deployment Services server will now process incoming client requests.

Message #

The Windows Deployment Services image server refreshed Image Cache successfully. The Windows Deployment Services server will now process incoming client requests.

Event ID 2164654350: Unattend file request was made over an insecure connection.

#
Channel
Unknown

Message #

Unattend file request was made over an insecure connection. Windows Deployment Services has blocked the request to keep the system secure. For more information, see: https://go.microsoft.com/fwlink/?linkid=2344403

Event ID 3238396162: An error occurred while trying to initialize the Windows Deployment Services image server.

#
Channel
Unknown

Message #

An error occurred while trying to initialize the Windows Deployment Services image server. 
 
 Error Information: %1

Event ID 3238396163: An error occurred while trying to shutdown the Windows Deployment Services image server.

#
Channel
Unknown

Message #

An error occurred while trying to shutdown the Windows Deployment Services image server. 
 
 Error Information: %1

Event ID 3238396164: An error occurred while processing an image enumeration request.

#
Channel
Unknown

Message #

An error occurred while processing an image enumeration request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396165: An error occurred while processing a client unattend request.

#
Channel
Unknown

Message #

An error occurred while processing a client unattend request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396166: An error occurred while processing an unattended variables request.

#
Channel
Unknown

Message #

An error occurred while processing an unattended variables request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396167: An error occurred while processing an initialize logging request.

#
Channel
Unknown

Message #

An error occurred while processing an initialize logging request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396168: An error occurred while processing a log message request.

#
Channel
Unknown

Message #

An error occurred while processing a log message request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396169: An error occurred while processing a domain join information request.

#
Channel
Unknown

Message #

An error occurred while processing a domain join information request. 
 
 Client Address: %1 
 Error Information: %2

Event ID 3238396170: An error occurred while refreshing settings.

#
Channel
Unknown

Message #

An error occurred while refreshing settings. 
 
 Error Information: %1

Event ID 3238396172: An error occurred while refreshing Image Cache.

#
Channel
Unknown

Description

An error occurred while refreshing Image Cache. The Windows Deployment Services server will not process incoming client requests.

Message #

An error occurred while refreshing Image Cache. The Windows Deployment Services server will not process incoming client requests.
 
 Error Information: %1

Event ID 3238396175: This system is using insecure settings for Windows Deployment Services.

#
Channel
Unknown

Message #

This system is using insecure settings for Windows Deployment Services. This may expose sensitive configuration files to interception. Apply Microsoft?s recommended security settings to protect your deployment. Learn more at: https://go.microsoft.com/fwlink/?linkid=2344403

Provenance

ETW provider GUID 40e6ca88-7257-4956-9872-9387ac052bc3

Defined in WdsImgSrv.dll, which carries the event manifest.