Windows / Modules / mrxsmb.sys

mrxsmb.sys

Associated Error Codes

Below lists error codes and symbolic names found for this module.

CodeFound inDescription
0x300000001011Info
0x3000000b1011Server Error
0x3000000c1011Cached Error
0x3000000d1011Initialize Security Context Error
0x3000000e1011Security Signature Error
0x300000b41011Start State
0x300000b51011End State
0x500000021011Error
0x500000031011Warning
0x500000041011Information
0x500000051011Verbose
0x900000011011Microsoft-Windows-SMBClient
0x900000021011Microsoft-Windows-SMBClient/HelperClassDiagnostic
0x900000031011Microsoft-Windows-SMBClient/ObjectStateDiagnostic
0x900000041011Microsoft-Windows-SMBClient/Operational
0x900000051011Microsoft-Windows-SMBClient/XPerfAnalytic
0x900000061011Microsoft-Windows-SMBClient/Diagnostic
0x900000071011Microsoft-Windows-SMBClient/Connectivity
0x900000081011Microsoft-Windows-SMBClient/Security
0x900000091011Microsoft-Windows-SMBClient/Audit
0xb00000651011Create SrvCall Error: %1 Location: %2 Context: %3
0xb00000c91011Session Setup Error: %1 Location: %2 Context: %3
0xb000012d1011Tree Connect Error: %1 Location: %2 Context: %3
0xb00001911011Create VNetRoot Error: %1 Location: %2 Context: %3
0xb00001f51011Create File Error: %1 Location: %2 Context: %3
0xb00007d01011Packet Fragment (%2 bytes)
0xb0004e211011Transitioned to State: %1 Context: %2
0xb00075971011SMB exchange suspended: RxContext %1 Exchange %2 ListHead %3
0xb00075981011SMB exchange resumed: RxContext %1 Exchange %2 ExchangeState %3 ExchangeStatus %4
0xb00075991011SMB buffer context suspended: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7
0xb000759a1011SMB buffer context resumed: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7
0xb000759c1011SMB Mid window blocked: Window %1 HungSession %2
0xb000759d1011SMB rechunk multi-credit request: BufferCtxt %1 Exchange %2 MidCharge %3 Window %4 CurrentWindowLimit %5 ThrottlingWindowLimit %6 CurrentWindowSize %7
0xb000759e1011SMB initialize Mid window: Server %2 Window %3
0xb000759f1011SMB Mid window state: Window %1 CurrentWindowSize %2 CurrentWindowLimit %3 ThrottlingWindowLimit %4 OldestPendingMid %5 NextAvailableMid %6 CreditsGranted %7
0xb00075a01011SMB teardown Mid window: Server %2 Window %3
0xb00075a11011SMB copy data completion: Status %1 VcEndpoint %2
0xb00075a21011SMB send completion: Status %1 VcEndpoint %2
0xb00075fb1011WSK connect: SocketAddress %2 VcEndpoint %3 Socket %4
0xb00075fc1011WSK connect completion: VcEndpoint %1 Socket %2 Status %3
0xb00075fd1011WSK send: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4
0xb00075fe1011WSK send completion: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4 Status %5
0xb00075ff1011WSK receive: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4
0xb00076001011WSK receive completion: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4 Status %5
0xb00076011011Compression requested for file object %3: Status %4
0xb00076021011Decompression failed: VcEndpoint %1 Socket %2 ReceiveBuffer %3 ReceiveLength %4 Status %5
0xb00076031011Compression failed: VcEndpoint %1 Socket %2 SendBuffer %3 SendLength %4 Status %5
0xb00076c11011SMB session expired: SessionEntry %1 ServerName %3
0xb00076c21011SMB 3 part SPN reauth: SessionEntry %1 ServiceName %3
0xb00076c31011SMB reconnect durable open: Fcb %1 SrvOpen %2
0xb00076c41011SMB defer open: Fcb %1 SrvOpen %2
0xb00076c51011SMB undefer open: Fcb %1 SrvOpen %2
0xb00076c61011SMB send[%1]: [%2] (Mid/Sid/Tid) (%3/%4/%5) MidCharge %6 Creds %7 SendLengh %8 VcEndpoint %9
0xb00076c71011SMB receive: [%1] (Mid/Sid/Tid) (%2/%4/%5) Creds %6 Status %7 VcEndpoint %8
0xb00076c81011SMB receive interim: [%1] (Mid/AsyncId/Sid/Tid) (%2/%3/%4/%5) Creds %6 Status %7 VcEndpoint %8
0xb00076c91011SMB receive async: [%1] (AsyncId/Sid/Tid) (%3/%4/%5) Creds %6 Status %7 VcEndpoint %8
0xb00076ca1011SMB registry key: %1 = %2
0xb00077251011SMB update file info cache: RxContext %1 Fcb %2 FileName %4
0xb00077261011SMB fetch file info cache: RxContext %1 Fcb %2 FileName %4 Status %5
0xb00077271011SMB invalidate file info cache: RxContext %1 Fcb %2 FileName %4
0xb00077281011SMB update file not found cache: RxContext %1 Fcb %2 FileName %4
0xb00077291011SMB fetch file not found cache: RxContext %1 Fcb %2 FileName %4 Result %5
0xb000772a1011SMB invalidate file not found cache: RxContext %1 Fcb %2 FileName %4
0xb000772b1011SMB populate dir cache: RxContext %1 Fcb %2 DirName %4
0xb000772c1011SMB fetch dir cache: RxContext %1 Fcb %2 FileName %4 Status %5
0xb00077881011Session %1 to %6 transitioned from [%2] to [%3] with Status %4
0xb00077891011Share connection %1 to %6 transitioned from [%2] to [%3] with Status %4
0xb000778b1011Open handle %1 to %10%12 transitioned from [%5] to [%6] with Status %7
0xb000778c1011The local computer didn't received an SMB1 negotiate response in the last 20 minutes.n Guidance: This event indicates that no attempt was made to contact this computer via the SMB1 protocol. After %1 online days of no SMB1 contact attempts, the SMB1 Client service will automatically uninstall.
0xb00077951011Failed to open a persistent handle. Error: %7 FileId: %2:%3 CreateGUID: %4 Path: %10%12 Reason: %8 Guidance: A persistent handle allows transparent failover on Windows File Server clusters. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.
0xb00077ed1011An invalid FSCTL_QUERY_NETWORK_INTERFACE_INFO response was sent by the server %2
0xb00077ee1011The client failed to connect to the server %2 from the local IP address %4 to the remote IP address %6 over TCP transport. Error: %7
0xb00077ef1011The client failed to connect to the server %2 from the local IP address %4 to the remote IP address %6 over RDMA transport. Error: %7
0xb00077f01011The client connected to the server %2 from the local IP address %4 to the remote IP address %6 over TCP transport successfully
0xb00077f11011The client connected to the server %2 from the local IP address %4 to the remote IP address %6 over RDMA transport successfully
0xb00078501011The server name cannot be resolved. Error: %2 Server name: %4 Guidance: The client cannot resolve the server address in DNS or WINS. This issue often manifests immediately after joining a computer to the domain, when the client's DNS registration may not yet have propagated to all DNS servers. You should also expect this event at system startup on a DNS server (such as a domain controller) that points to itself for the primary DNS. You should validate the DNS client settings on this computer using IPCONFIG /ALL and NSLOOKUP.
0xb00078511011%1. Error: %2 Server name: %4
0xb000785310Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6 Connection type: %7 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter, can also cause this issue.
0xb000785410A network connection was disconnected. Server name: %4 Server address: %6 Connection type: %7 Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.
0xb00078591011A request timed out because there was no response from the server. Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Instance Name: %9 RetryCount: %10 ElapsedTime(ms): %11 Guidance: The server is responding over TCP but not over SMB. Ensure the Server service is running and responsive, and the disks do not have high per-IO latency, which makes the disks appear unresponsive to SMB. Also, ensure the server is responsive overall and not paused; for instance, make sure you can log on to it.
0xb000785a1011Added a TCP/IP transport interface. Name: %2 InterfaceIndex: %3 Guidance: A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.
0xb000785b1011Deleted a TCP/IP transport interface. Name: %2 InterfaceIndex: %3 Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.
0xb000785c1011Added a TDI transport interface. Name: %2 Guidance: A TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.
0xb000785d1011Deleted a TDI transport interface. Name: %2 Guidance: A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.
0xb000785e10Witness registration has completed. Status: %1 Cluster share name: %4 Cluster share type: %2 File server cluster address: %6 Guidance: The client successfully registered with the SMB Witness through RPC using TCP (port 135, then an endpoint port above 1023). No action is required.
0xb000785f1011Witness deregistration has completed. Status: %1 Cluster share name: %4 Cluster share type: %2 Guidance: The client successfully de-registered with the SMB Witness through RPC using TCP (port 135, then an endpoint port above 1023). No action is required.
0xb00078601011The server failed the negotiate request. Error: %2 Server name: %4 Guidance: The server does not support any dialect that the client is trying to negotiate, such as the client has SMB2/SMB3 disabled and the server has SMB1 disabled.
0xb00078611011Close request failed. Error: %2 Path: %4%6 Guidance: A persistent handle (Continuous Availability) or a resilient handle failed to close.
0xb00078621011RDMA interfaces are available but the client failed to connect to the server over RDMA transport. Server name: %2 Guidance: Both client and server have RDMA (SMB Direct) adaptors but there was a problem with the connection and the client had to fall back to using TCP/IP SMB (non-RDMA).
0xb000786610Failed to establish an SMB multichannel network connection. Error: %2 Server name: %4 Server address: %6 Client address: %7 Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue. Since the error occurred while trying to connect extra channels, it will not result in an application error. This event is for diagnostics only.
0xb000786c1011The client established its session to the server. Server name: %4 Server address: %6!S! Client address: %8!S! Session ID: %2
0xb000786d1011The client failed to establish its session to the server. Error: %1 Server name: %4 Server address: %6!S! Client address: %8!S! Session ID: %2
0xb00078ba1011A request on persistent/resilient handle failed because the handle was invalid or it exceeded the timeout. Status: %7 Type: %1 Path: %4%6 Restart count: %2 Guidance: After retrying a request on a Continuously Available (Persistent) handle or a Resilient handle, the client was unable to reconnect the handle. This event is the result of a handle recovery failure. Review other events for more details.
0xb00078bb1011The SMB Multichannel registry value is not configured with default settings. Default Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "DisableMultiChannel"=dword:0 Configured Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "DisableMultiChannel"=dword:%2 Guidance: You can configure SMB Multichannel on the client using the Windows PowerShell cmdlet Set-SmbClientConfiguration. Disabling SMB client multichannel support is not a recommended configuration, as it can lead to degraded performance and decreased reliability if one channel or network path fails.
0xb00078bc1011The SMB 3 and SMB 2 driver is not configured with the default start type. Default Start Type: DEMAND_START Configured Start Type: DISABLED Guidance: You should expect this event when disabling SMB2/SMB3 for the client using SC.EXE or editing the Windows registry. Microsoft does not recommend disabling SMB2/SMB3. Disabling SMB2/SMB3 prevents use of features such as SMB Transparent Failover, SMB Scale Out, SMB Multichannel, SMB Direct (RDMA), SMB Encryption, VSS for SMB file shares, and SMB Directory Leasing. SMB provides alternative troubleshooting workarounds to disabling SMB2/SMB3 in most cases.
0xb00078bd1011The client supports SMB Direct (RDMA) and SMB Signing is in use. Share name: %2 Guidance: For optimal SMB Direct performance, you can disable SMB Signing. This configuration is less secure and you should only consider this configuration on trustworthy private networks with strict access control.
0xb00078be1011The client supports SMB Direct (RDMA) and SMB Encryption is in use. Share name: %2 Guidance: For optimal SMB Direct performance, you can disable SMB Encryption on the server for shares accessed by this client. This configuration is less secure and you should only consider this configuration on trustworthy private networks with strict access control.
0xb00078bf1011The Cipher Suite Order group policy setting is invalid. Guidance: This event indicates that an administrator has configured an invalid value for the "Computer Configuration\Administrative Templates\Network\Lanman Workstation\Cipher Suite Order" group policy setting. The client will use the default cipher suite order "%1" until this error is resolved.
0xb00078c01011The RequireSecureNegotiate setting has been removed. Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters Registry Value: RequireSecureNegotiate Guidance: You should expect this event when an administrator configures the RequireSecureNegotiate setting. Secure negotiate prevents man-in-the-middle attacks against SMB connection establishment. Previous versions of Windows allowed secure negotiate to be disabled. Disabling secure negotiate is no longer allowed. The client removed the setting from the registry. No user action is required.
0xb00079181011%1. Error: %2 Security status: %3 User name: %10 Logon ID: %4 Serrver name: %6
0xb00079191011%1. Error: %2 Security status: %3 User name: %10 Logon ID: %4 Server name: %6 Principal name: %8
0xb000791a1011The outbound authentication failed using a network token. Error: %2 Server name: %4 Guidance: This typically indicates that delegation must be configured for a Kerberos double-hop scenario. If delegation is configured, confirm that the services are configured correctly on the middle-tier server.
0xb000791b1011The LmCompatibilityLevel value is different from the default. Configured LM Compatibility Level: %2 Default LM Compatibility Level: 3 Guidance: LAN Manager (LM) authentication is the protocol used to authenticate Windows clients for network operations. This includes joining a domain, accessing network resources, and authenticating users or computers. This determines which challenge/response authentication protocol is negotiated between the client and the server computers. Specifically, the LM authentication level determines which authentication protocols the client will try to negotiate or the server will accept. The value set for LmCompatibilityLevel determines which challenge/response authentication protocol is used for network logons. This value affects the level of authentication protocol that clients use, the level of session security negotiated, and the level of authentication accepted by servers. Value (Setting) - Description 0 (Send LM & NTLM responses) - Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication. 1 (Send LM & NTLM - use NTLMv2 session security if negotiated) - Clients use LM and NTLM authentication, and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication. 2 (Send NTLM response only) - Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication. 3 (Send NTLM v2 response only) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication. 4 (Send NTLMv2 response only/refuse LM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and accept only NTLM and NTLMv2 authentication. 5 (Send NTLM v2 response only/refuse LM & NTLM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM and accept only NTLMv2 authentication. Incompatibly configured LmCompatibility levels between a client and server (such as 0 on a client and 5 on a server) prevent access to the server. Non-Microsoft clients and servers also provide these configuration settings.
0xb00079221011The SMB client failed to connect to the share. Error: %2 Path: %4%6
0xb000792410The negotiate validation failed. From negotiate response: Dialect: %1 SecurityMode: %2 Capabilities: %3 ServerGuid: %4 From FSCTL_VALIDATE_NEGOTIATE_INFO response: Dialect: %5 SecurityMode: %6 Capabilities: %7 ServerGuid: %8 Guidance: The client successfully negotiated SMB dialect, security mode, capabilities and server GUID with the server, but the validation of these values then failed after connecting to a share. This may be due to a "man-in-the-middle" compromise attempt.
0xb000792510The signing validation failed. Error:%7 Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "man-in-the-middle" compromise attempt. PacketFragment:%9
0xb000792610The client received an unencrypted message when encryption was expected. Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Instance Name: %9 Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "man-in-the-middle" compromise attempt.
0xb00079271011Failed to decrypt an encrypted SMB message. Error:%7 Server name: %6 Session ID:%3 Instance Name: %9 Guidance: The client received an encrypted SMB message but cannot decrypt the data. This typically means that the communication came from a previous session that no longer exists. The encryption header may also have been damaged or tampered with on the network between the client and server.
0xb00079281011The SMB Signing registry value is not configured with default settings. Default Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "EnableSecuritySignature"=dword:1 Configured Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "EnableSecuritySignature"=dword:0 Guidance: Even though you can disable, enable, or require SMB Signing, the negotiation rules changed starting with SMB2 and not all combinations operate like SMB1. The effective behavior for SMB2/SMB3 is: Client Required and Server Required = Signed Client Not Required and Server Required = Signed Server Required and Client Not Required = Signed Server Not Required and Client Not Required = Not Signed When requiring SMB Encryption, SMB Signing is not used, regardless of settings. SMB Encryption implicitly provides the same integrity guarantees as SMB Signing.
0xb00079291011Rejected an insecure guest logon. User name: %2 Server name: %4 Guidance: This event indicates that the server attempted to log the user on as an unauthenticated guest and was denied by the client. Guest logons do not support standard security features such as signing and encryption. As a result, guest logons are vulnerable to man-in-the-middle attacks that can expose sensitive data on the network. Windows disables insecure guest logons by default. Microsoft does not recommend enabling insecure guest logons.
0xb000792a10The %1 registry value is not configured with default settings. Default Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "%1"=dword:0 Configured Registry Value: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "%1"=dword:%2 Guidance: This event indicates that an administrator has enabled insecure guest logons. An insecure guest logon occurs when a server logs the user on as an unauthenticated guest, typically in response to an authentication failure. Guest logons do not support standard security features such as signing and encryption. As a result, allowing guest logons makes the client vulnerable to man-in-the-middle attacks that can expose sensitive data on the network. Windows disables insecure guest logons by default. Microsoft does not recommend enabling insecure guest logons.
0xb000792b1011Mutual authentication was unexpectedly lost after re-authenticating to %6 User %8 LogonID %4 Status %2 AuthProtocol Old %9 New %10 MutualAuthState Old %11 New %12 Clustered %13
0xb0007d001011SMB1 negotiate response received from remote device when SMB1 cannot be negotiated by the local computer. Dialect: %1 Server name: %3 Guidance: The client has SMB1 disabled or uninstalled. For more information: https://go.microsoft.com/fwlink/?linkid=852747.
0xb0007d0210The local computer received an SMB1 negotiate response. Dialect: %1 SecurityMode %3 Server name: %5 Guidance: SMB1 is deprecated and should not be installed nor enabled. For more information, see https://go.microsoft.com/fwlink/?linkid=852747.
0xb0007d0310The local computer didn't received an SMB1 negotiate response in the last %1 days.n Guidance: This event indicates that after detecting no attempts to contact this computer via the SMB1 protocol for %1 online days, the SMB1 Client service was automatically uninstalled.
0xb0009c401011Packet (%4 bytes)
0xb001786810The connection was forcibly disconnected. Error: %2 Name: %4 Server address: %6 Client address: %7 Instance name: %9 Connection type: %10 Guidance: This connection is disconnected to force existing requests to fail back as soon as possible. This is a fast-fail mechanism to allow upper layers to apply their recovery policies as soon as possible. This event is for diagnostics only.
0xb00178691011The disconnect state on connection was cleared Name: %3 Instance name: %5 Guidance: Any persistent disconnect state on this connection is cleared. Any new IO will be sent to the server as usual. This event is for diagnostics only.
0xb00275fb1011%5 connect: SocketAddress %2 VcEndpoint %3 Socket %4
0xb00275fc1011%4 connect completion: VcEndpoint %1 Socket %2 Status %3
0xb00275fd1011%5 send: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4
0xb00275fe1011%6 send completion: VcEndpoint %1 Socket %2 SendMdl %3 SendLength %4 Status %5
0xb00275ff1011%5 receive: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4
0xb00276001011%6 receive completion: VcEndpoint %1 Socket %2 ReceiveMdl %3 ReceiveLength %4 Status %5
0xb00277931011Failed to reconnect a persistent handle. Error: %7 FileId: %2:%3 CreateGUID: %4 Path: %10%12 Reason: %8 Previous reconnect error: %13 Previous reconnect reason: %14 Guidance: A persistent handle allows transparent failover on Windows File Server clusters. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.
0xb00277941011Failed to reconnect a resilient handle. Error: %7 FileId: %2:%3 Path: %10%12 Reason: %8. Previous reconnect error: %13 Previous reconnect reason: %14 Guidance: A resilient handle provides guarantees to applications requesting it. This event has many causes and does not always indicate an issue with SMB. Review online documentation for troubleshooting information.
0xb002785310Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6 Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
0xb002785410A network connection was disconnected. Instance name: %4 Server name: %6 Server address: %8 Connection type: %9 InterfaceId: %10 Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.
0xb00278551011The client lost its session to the server. Error: %1 Server name: %5 Session ID: %2 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.
0xb002785610The client re-established its session to the server. Server name: %5 Server address: %7 Session ID: %2 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.
0xb00278571011The connection to the share was lost. Error: %1 Share name: %5 Session ID: %2 Tree ID: %3 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.
0xb002785810The connection to the share was re-established. Share name: %5 Server address: %7 Session ID: %2 Tree ID: %3 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.
0xb002786310The SMB client received a request to move to a different node on a file server cluster. File server cluster name: %4 New file server cluster address: %6 Guidance: Continuous Availability (Transparent Failover) is in use and the client computer is going to move to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.
0xb002786410The SMB client successfully moved to a different node on a file server cluster. File server cluster name: %4 New file server cluster address: %6 Guidance: Continuous Availability (Transparent Failover) is in use and the client computer successfully moved to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.
0xb00278651011The SMB client failed to move to a different node on a file server cluster. Error: %1 File server cluster name: %4 Guidance: Continuous Availability (Transparent Failover) is in use and the client computer failed to move to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). The attempt to connect to the destination server failed, which is typically due to a network configuration issue. For example, this issue may occur if the destination node's IP address cannot be resolved, if the destination node is behind a firewall, or if there is no network route from the client to the node.
0xb002786710The connection was terminated due to one or more IO request timeouts. Error: %2 Name: %4 Server address: %6 Client address: %7 Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or the storage stack on the remote server. IO operations were not completed within the allotted time. The application may not see this failure because IOs are usually retried on a different connection. This event is for diagnostics only.
0xb00278b41011The handle was created without persistence. File ID: %2:%3 CreateGUID: %4 Path: %10%12 Guidance: The server supports Continuous Availability (persistent handles) and the request to create the handle succeeded. However, the server did not grant persistence. You should verify that the Resume Key Filter is running on the server and is attached to the target volume.
0xb00278b81011The server does not support multichannel. Server name: %2 Guidance: The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.
0xb00278b91011The client cannot connect to the server due to a multichannel constraint registry setting. Server name: %2 Guidance: The client attempted to use SMB Multichannel, but an administrator has configured multichannel support to prevent multichannel on the client. You can configure SMB Multichannel on the client using the Windows PowerShell cmdlets: New-SmbMultichannelConstraint and Remove-SmbMultichannelConstraint.
0xd00000011011Active
0xd00000021011Disconnected
0xd00000031011Suspended
0xd00000041011Construction in progress
0xd00000051011Recovery in progress
0xd00000061011Disconnect in progress
0xd00000071011Invalidation in progress
0xd00000081011Invalid
0xd00000091011Deleted
0xd000000a10Tdi
0xd000000b10Wsk
0xd000000c1011Rdma
0xd000000d1011VMBUS
0xd000000e1011Quic
0xd000000f1011Smb2DiagReasonNotSpecified
0xd00000101011Smb2DiagReasonDns
0xd00000111011Smb2DiagReasonSetSocketSecurity
0xd00000121011Smb2DiagReasonIPSec
0xd00000131011Smb2DiagReasonNetworkConnect
0xd00000141011Smb2DiagReasonNegotiateValidation
0xd00000151011Smb2DiagReasonExchangeExpiry
0xd00000161011Smb2DiagReasonDisconnectIndication
0xd00000171011Smb2DiagReasonNegativeCache
0xd00000181011Smb2DiagReasonConsecutiveSessionSetupFailures
0xd00000191011Smb2DiagReasonQuicServerCertificateError
0xd000001a1011Smb2DiagReasonQuicServerConfigFailure
0xd000001b10Smb2DiagReasonAcquireCredHandle
0xd000001c10Smb2DiagReasonISC
0xd000001d10Smb2DiagReasonSessionSetupResponse
0xd000001e10Smb2DiagReasonMADowngrade
0xd000001f10Smb2DiagReasonCreateSigningKey
0xd000002010Smb2DiagReasonRegisterCryptoKeys
0xd000002110Smb2DiagReasonQCA
0xd000002210Smb2DiagReasonEncryptionOnNullSession
0xd000002310Smb2DiagReasonTreeConnectResponse
0xd000002410Smb2DiagReasonValidateNegotiateFsctl
0xd000002510Smb2DiagReasonHandleReconnect
0xd000002610Smb2DiagReasonCreateResponse
0xd000002710Smb2DiagReasonExchangeCancellation
0xd000002810Smb2DiagReasonExchangeNoBindingObject
0xd000002910Smb2DiagReasonExchangeSendFailure
0xd000002a10Smb2DiagReasonObjectSuspended
0xd000002b10Smb2DiagReasonUserDisconnect
0xd000002c10Smb2DiagReasonHandleClosed
0xd000002d10Smb2DiagDisconnectReasonReceiveContextAllocation
0xd000002e10Smb2DiagDisconnectReasonPaddingAllocation
0xd000002f10Smb2DiagDisconnectReasonExchangeReceiveHandlerError
0xd000003010Smb2DiagDisconnectReasonMessageBufferAllocation
0xd000003110Smb2DiagDisconnectReasonVcEndpointTornDown
0xd000003210Smb2DiagDisconnectReasonMessageSizeReceiveError
0xd000003310Smb2DiagDisconnectReasonMessageSizeTooLargeError
0xd000003410Smb2DiagDisconnectReasonMessageCopyError
0xd000003510Smb2DiagDisconnectReasonVcReceiveHandlerError
0xd000003610Smb2DiagDisconnectReasonVcReceiveError
0xd000003710Negotiate
0xd000003810Session setup
0xd000003910Logoff
0xd000003a10Tree connect
0xd000003b10Tree disconnect
0xd000003c10Create
0xd000003d10Close
0xd000003e10Flush
0xd000003f10Read
0xd000004010Write
0xd000004110Lock
0xd000004210Ioctl
0xd000004310Cancel
0xd000004410Echo
0xd000004510Query directory
0xd000004610Change notify
0xd000004710Query info
0xd000004810Set info
0xd000004910Oplock break
0xd000004a10Create
0xd000004b10Close
0xd000004c10Read
0xd000004d10Write
0xd000004e10Query information
0xd000004f10Set information
0xd000005010Query EA
0xd000005110Set EA
0xd000005210Flush buffers
0xd000005310Query volume information
0xd000005410Set volume information
0xd000005510Directory control
0xd000005610File system control
0xd000005710Device control
0xd000005810Internal device control
0xd000005910Lock control
0xd000005a10Cleanup
0xd000005b10Query security
0xd000005c10Set security
0xd000005d10Query quota information
0xd000005e10Set quota information
0xd000005f10Internal probe I/O
0xd000006010Symmetric
0xd000006110Asymmetric
0x1000000111Perf
0x1000000211NetworkingPerf
0x1000000311Info
0x1000000411InfoCacheInfo
0x1000000511TFO
0x1000000611Multichannel
0x1000000711Connectivity
0x1000000811Authentication
0x1000000911Authorization
0x1000000a11Security
0x1000000b11IOPerf
0x1000000c11PerfSummary
0x1000000d11PerfRundown
0x1000000e11IOPerfOptional
0x1000001111ConnectivityNoisy
0x1000001f11PacketStart
0x1000002011PacketEnd
0x1000002111SendPath
0x1000002211ReceivePath
0x1000002b11Packet
0x1000002f11Diagnostic
0x1000003011PduFull
0x3000000111Start
0x7000000111Smb2PerfRxContextStart
0x7000000211Smb2PerfExchangeStart
0x7000000311Smb2PerfBufferContextStart
0x7000000411Smb2PerfRxContextStop
0x7000000511Smb2PerfExchangeStop
0x7000000611Smb2PerfBufferContextStop
0x7000000711Smb2PerfWorkTransition
0x7000000811Smb2PerfRxContextReadSummary
0x7000000911Smb2PerfRxContextWriteSummary
0x7000000a11Smb2PerfRxContextCreateSummary
0x7000000b11Smb2PerfRxContextCloseSummary
0x7000000c11Smb2PerfRxContextQueryDirectorySummary
0x7000000d11Smb2PerfRxContextFsctlSummary
0x7000000e11Smb2PerfExchangeReadSummary
0x7000000f11Smb2PerfExchangeWriteSummary
0x7000001011Smb2PerfExchangeCreateSummary
0x7000001111Smb2PerfExchangeCloseSummary
0x7000001211Smb2PerfExchangeQueryDirectorySummary
0x7000001311Smb2PerfExchangeFsctlSummary
0x7000001411Smb2PerfBufferContextReadSummary
0x7000001511Smb2PerfBufferContextWriteSummary
0x7000001611Smb2PerfBufferContextCreateSummary
0x7000001711Smb2PerfBufferContextCloseSummary
0x7000001811Smb2PerfBufferContextQueryDirectorySummary
0x7000001911Smb2PerfBufferContextFsctlSummary
0x7000001a11Smb2PerfFCBCaptureSummary
0x7000001b11CreateSrvCallError
0x7000001c11SessionSetupError
0x7000001d11CreateVNetRootError
0x7000001e11CreateFileError
0x7000001f11CreateFile
0x7000002011SmbSuspendExchange
0x7000002111SmbResumeExchange
0x7000002211SmbResumeBufferCtxt
0x7000002311SmbMidWindowBlocked
0x7000002411SmbRechunkRequest
0x7000002511SmbInitializeMidWindow
0x7000002611SmbMidWindowState
0x7000002711SmbTeardownMidWindow
0x7000002811SmbDataReady
0x7000002911SmbSendCompletion
0x7000002a11NetConnect
0x7000002b11NetConnectCompletion
0x7000002c11NetSend
0x7000002d11NetSendCompletion
0x7000002e11NetReceive
0x7000002f11NetReceiveCompletion
0x7000003011CompressionRequested
0x7000003111DecompressionFailure
0x7000003211CompressionFailure
0x7000003311SmbSessionExpired
0x7000003411Smb3PartSPNReauth
0x7000003511SmbReconnect
0x7000003611SmbDeferOpen
0x7000003711SmbUndeferOpen
0x7000003811SmbSend
0x7000003911SmbReceive
0x7000003a11SmbReceiveInterim
0x7000003b11SmbReceiveAsync
0x7000003c11SmbRegistryKey
0x7000003d11SmbUpdateInfoCache
0x7000003e11SmbFetchInfoCache
0x7000003f11SmbInvalidateInfoCache
0x7000004011SmbUpdateFNFCache
0x7000004111SmbFetchFNFCache
0x7000004211SmbInvalidateFNFCache
0x7000004311SmbPopulateDirCache
0x7000004411SmbFetchDirCache
0x7000004511SessionStateTransition
0x7000004611VNetRootStateTransition
0x7000004711OpenHandleStateTransition
0x7000004811NoSMB1ObservedInLastPeriod
0x7000004911PersistentHandleFailure
0x7000004a11ResilientHandleFailure
0x7000004b11HandleOpenFailure
0x7000004c11ServerNetworkInterfaceInvalid
0x7000004d11WskConnectFailure
0x7000004e11RdmaConnectFailure
0x7000004f11WskConnectSuccess
0x7000005011RdmaConnectSuccess
0x7000005111WskGetAddressInfoFailure
0x7000005211SetSocketSecurityFailure
0x7000005311IPSecFailure
0x7000005411NetworkConnectFailure
0x7000005511DisconnectIndication
0x7000005611SessionFailure
0x7000005711SessionEstablished
0x7000005811ShareConnectionFailure
0x7000005911ShareConnectionEstablished
0x7000005a11ExpiredExchange
0x7000005b11TcpIpTransportArrival
0x7000005c11TcpIpTransportRemoval
0x7000005d11TdiTransportArrival
0x7000005e11TdiTransportRemoval
0x7000005f11WitnessRegistration
0x7000006011WitnessDeregistration
0x7000006111NegotiateFailure
0x7000006211CloseFailure
0x7000006311RdmaFallback
0x7000006411WitnessMove
0x7000006511WitnessMoveSuccess
0x7000006611WitnessMoveFailure
0x7000006711MultiChannelNetworkConnectFailure
0x7000006811HungConnectionFailure
0x7000006911ConnectionForceDisconnected
0x7000006a11ConnectionDisconnectStateCleared
0x7000006b11NegotiateResponseEncryptionCapabilitiesFailure
0x7000006c11CertificateMappingNotFound
0x7000006d11SessionEstablishedNoisy
0x7000006e11SessionSetupErrorNoisy
0x7000006f11SmbConnectionInitiatedSelectedInfo
0x7000007011HandlePersistenceNotGranted
0x7000007111ServerMultiChannelIncapable
0x7000007211ServerMultiChannelConstraint
0x7000007311RequestRetryFailure
0x7000007411MultiChannelDisabled
0x7000007511Smb2Disabled
0x7000007611RdmaWithSigning
0x7000007711RdmaWithEncryption
0x7000007811InvalidCipherSuiteOrder
0x7000007911RequireSecureNegotiateIsDeprecated
0x7000007a11IsolatedTransportServerEntryInfo
0x7000007b11SmbRdmaRundownActive
0x7000007c11SmbRdmaRundownComplete
0x7000007d11SmbRdmaReactivation
0x7000007e11SmbRdmaReactivationComplete
0x7000007f11SmbRdmaSMBDirectLoad
0x7000008011SmbComponentCapabilities
0x7000008111SmbInvalidPortSpecified
0x7000008211SmbConnectionInitiatedNotSelectedInfo
0x7000008311SmbDialectChange
0x7000008411AcquireCredHandleFailure
0x7000008511ISCFailure
0x7000008611NetworkTokenFailure
0x7000008711LMCompatibilityLevel
0x7000008811TreeConnectFailure
0x7000008911NegotiateValidationFailure
0x7000008a11SigningFailure
0x7000008b11EncryptionFailure
0x7000008c11DecryptionFailure
0x7000008d11EnableSecuritySignatureNonDefault
0x7000008e11RejectedInsecureGuestAuth
0x7000008f11InsecureGuestAuthEnabled
0x7000009011MADowngradeDetected
0x7000009111SessionKeyTooShort
0x7000009211DirectDataPlacementSecurity
0x7000009311UnexpectedSMB1ResponseReceived
0x7000009411SMB1ResponseReceived
0x7000009511UninstallSMB1Client
0x7000009611PacketFragment
0x7000009711Packet
0x7000009811TreeConnectError
0x7000009911SmbSuspendBufferCtxt
0x7000009a11SmbLsassCallDurationInfo
0x7000009b11SmbLsassCallDurationWarning
0x7000009c11AllowedInsecureGuestAuth
0x7000009d11ServerDoesNotSupportSigning
0x7000009e11ServerDoesNotSupportEncryption
0x7000009f11InsecureGuestLogon
0x700000a011MutualAuthServerDeniedAccess
0x700000a111ConnectionEstablished
0x700000a211NTLMBlocked
0x700000a311ShareInitialConnectionEstablished
0x700000a411ServerCertificateRevocationChecksFailed
0x700000a511ServerAuthenticationFailure
0x700000a711RequestedTransportDisabled
0xb000785311Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6!S! Connection type: %7 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter, can also cause this issue.
0xb000785411A network connection was disconnected. Server name: %4 Server address: %6!S! Connection type: %7 Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.
0xb000785e11Witness registration has completed. Status: %1 Cluster share name: %4 Cluster share type: %2 File server cluster address: %6!S! Guidance: The client successfully registered with the SMB Witness through RPC using TCP (port 135, then an endpoint port above 1023). No action is required.
0xb000786611Failed to establish an SMB multichannel network connection. Error: %2 Server name: %4 Server address: %6!S! Client address: %7!S! Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue. Since the error occurred while trying to connect extra channels, it will not result in an application error. This event is for diagnostics only.
0xb000786a11The SMB negotiate response processing failed on the client to determine the selected encryption cipher for the client and server. Please ensure there is a common cipher between the client and server. Client encryption cipher suite order (most to least preferred): %2 Server replied back with its selected encryption cipher ID: %4
0xb000786b11Could not find a certificate mapping that matches the server name. Connection type: %1 Server name: %3.
0xb000786e11The SMB redirector selected the connection initiated with the following parameters: Server name: %2 Server socket address: %5 Client socket address: %7 Client certificate thumbprint: %12 Transport: %3 Instance Name: %9
0xb000786f11The SMB client was denied access to the SMB server during mutual authentication. Server name: %2 Server socket address: %5 Client socket address: %7 Client certificate thumbprint: %11 Transport: %3 Instance Name: %9
0xb000787011The SMB connection was successfully established. Server name: %2 Server socket address: %5 Client socket address: %7 Connection ID: %12 Client certificate thumbprint: %14 Transport: %3 Instance Name: %9 Port Origin: %10 Guidance: The event occurs when server authentication succeeds. The connection may later be closed if client authentication fails or if the client is denied access to the server.
0xb000787111The initial connection to the share was established. Share name: %5 Server address: %7!S! Session ID: %2 Tree ID: %3 Transport type: %8 Signing used: %9 Encryption used: %10 Compression requested: %11 NTLM blocked: %12
0xb000787211The client was unable to perform revocation checks on the server certificate chain. The connection will proceed. Verification Status: %1 Server name: %3 Server socket address: %6 Client socket address: %8 Connection ID: %13 Client certificate thumbprint: %15 Transport: %4 Instance Name: %10 Port Origin: %11
0xb000787311Server authentication failed. Error: %1 Server name: %3 Server socket address: %6 Client socket address: %8 Connection ID: %13 Client certificate thumbprint: %15 Transport: %4 Instance Name: %10 Port Origin: %11
0xb000787511The requested transport is disabled. Server name: %2 Server socket address: %5 Transport: %3
0xb00078c111Server %2 share %4 has requested client to use isolated connections to connection to the share. Asymmetric flag %5. Isolated transport flag %6. NetRoot already use isolated connections %7.
0xb00078c211RDMA rundown is active. Active RDMA-based operations will be wound down. There are currently %1 active RDMA resources.
0xb00078c311RDMA rundown is complete. No further RDMA-based operations are allowed. Rundown no-op: %1.
0xb00078c411Reactivation of RDMA support has commenced.
0xb00078c511RDMA is no longer disabled. RDMA-based operations can proceed, given hardware capabilities and OS policy. No-op: %1.
0xb00078c611SMBDirect load attempt complete. Success: %1 Status code: %2 Service path: %4
0xb00078e611Component capabilities: %1 Internal patch number: %2
0xb00078e711The alternative port %1 is not a valid port within the range 0 to 65535 for mapping name %3:%5.
0xb00078e811The SMB redirector did not select the connection initiated with the following parameters: Server name: %2 IP Address: %5 Transport: %3 Instance Name:%7 Port Origin: %8 The failure status associated with this decision: %9
0xb00078e911SMB Dialect Change %1 was changed from %2 to %3.
0xb00078ea11It took %2 secs to execute %1.
0xb00078eb11It took %2 secs to execute %1 which is longer than threshold of %3 secs. This warning is because %1 is taking longer than expected.
0xb000792411The negotiate validation failed. From negotiate response: Dialect: %1 SecurityMode: %2 Capabilities: %3 ServerGuid: %4 From FSCTL_VALIDATE_NEGOTIATE_INFO response: Dialect: %5 SecurityMode: %6 Capabilities: %7 ServerGuid: %8 Guidance: The client successfully negotiated SMB dialect, security mode, capabilities and server GUID with the server, but the validation of these values then failed after connecting to a share. This may be due to a "adversary-in-the-middle" compromise attempt.
0xb000792511The signing validation failed. Error:%7 Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt. PacketFragment:%9
0xb000792611The client received an unencrypted message when encryption was expected. Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Instance Name: %9 Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt.
0xb000792a11Guidance: An administrator has enabled AllowInsecureGuestAuth. Clients using insecure guest logons are more vulnerable to attackers-in-the-middle, phishing, and malware.
0xb000792c11Session key for connection is weaker than required. Connection will be closed as a result. Server: %2 User: %6 Session key length: %3 Required Session key length: %4 Guidance: To establish a connection with a shorter session key, set the following registry DWORD value name with the value as decimal bits: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "MinimumSessionKeyLength" Important: If you have configured the 'Network security: Configure encryption types allowed for Kerberos' security policy to prevent use of 256-bit keys but also set the MinimumSessionKeyLength greater than 128 bits, the computer will not be able to make SMB connections. Setting MinimumSessionKeyLength higher than 128 bits will also prevent SMB connections using NTLM.
0xb000792d11SMB DDP security changed from %1 to %2.
0xb000792e11Allowed an insecure guest logon. User name: %2 Server name: %4 Guidance: This event indicates that the server attempted to log the user on as an unauthenticated guest and was allowed by the client.
0xb000792f11NTLM is prohibited for authentication on the server Server name: %2 NTLM was disabled by user or by administrator using policies. For more information: https://go.microsoft.com/fwlink/?linkid=2267451.
0xb0007cfd11The SMB client was logged on as Guest account. Server name: %2
0xb0007cfe11The SMB client observed that the server doesn't support signing. Server name: %2 Client requires signing: %3
0xb0007cff11The SMB client observed that the server doesn't support encryption. Server name: %2 Client requires encyption: %3
0xb0007d0211The local computer received an SMB1 negotiate response. Dialect: %2 SecurityMode %3 Server name: %5 Guidance: SMB1 is deprecated and should not be installed nor enabled. For more information, see https://go.microsoft.com/fwlink/?linkid=852747.
0xb0007d0311The local computer didn't received an SMB1 negotiate response in the last %1 days.n Guidance: This event indicates that after detecting no attempts to contact this computer via the SMB1 protocol for %1 online days, the SMB1 Client service was automatically uninstalled. The computer must be restarted for SMB1 removal to take effect.
0xb0007d0411SMB2 rxcontext performance work started
0xb0007d0511SMB2 exchange performance work started
0xb0007d0611SMB2 buffer context performance work started
0xb0007d0711SMB2 performance work transition
0xb0007d0811SMB2 rxcontext performance work read summary
0xb0007d0911SMB2 rxcontext performance work write summary
0xb0007d0a11SMB2 rxcontext performance work create summary
0xb0007d0b11SMB2 rxcontext performance work close summary
0xb0007d0c11SMB2 rxcontext performance work query directory summary
0xb0007d0d11SMB2 rxcontext performance work fsctl summary
0xb0007d1c11SMB2 exchange performance work read summary
0xb0007d1d11SMB2 exchange performance work write summary
0xb0007d1e11SMB2 exchange performance work create summary
0xb0007d1f11SMB2 exchange performance work close summary
0xb0007d2011SMB2 exchange performance work query directory summary
0xb0007d2111SMB2 exchange performance work fsctl summary
0xb0007d3011SMB2 buffer context performance work read summary
0xb0007d3111SMB2 buffer context performance work write summary
0xb0007d3211SMB2 buffer context performance work create summary
0xb0007d3311SMB2 buffer context performance work close summary
0xb0007d3411SMB2 buffer context performance work query directory summary
0xb0007d3511SMB2 buffer context performance work fsctl summary
0xb0007d4411SMB2 FCB capture summary
0xb001786811The connection was forcibly disconnected. Error: %2 Name: %4 Server address: %6!S! Client address: %7!S! Instance name: %9 Connection type: %10 Guidance: This connection is disconnected to force existing requests to fail back as soon as possible. This is a fast-fail mechanism to allow upper layers to apply their recovery policies as soon as possible. This event is for diagnostics only.
0xb001787211The client was unable to perform revocation checks on the server certificate chain. The connection will proceed. Verification Status: %1 Server name: %3 Server socket address: %6 Client socket address: %8 Client certificate thumbprint: %12 Transport: %4 Instance Name: %10
0xb001787311Server authentication failed. Error: %1 Server name: %3 Server socket address: %6 Client socket address: %8 Client certificate thumbprint: %12 Transport: %4 Instance Name: %10
0xb00178c611SMBDirect load attempt complete. Success: %1 Status code: %2 Service path: %4 Device name: %6
0xb002785311Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6!S! Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
0xb002785411A network connection was disconnected. Instance name: %4 Server name: %6 Server address: %8!S! Connection type: %9 InterfaceId: %10 Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.
0xb002785611The client re-established its session to the server. Server name: %5 Server address: %7!S! Session ID: %2 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.
0xb002785811The connection to the share was re-established. Share name: %5 Server address: %7!S! Session ID: %2 Tree ID: %3 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.
0xb002786311The SMB client received a request to move to a different node on a file server cluster. File server cluster name: %4 New file server cluster address: %6!S! Guidance: Continuous Availability (Transparent Failover) is in use and the client computer is going to move to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.
0xb002786411The SMB client successfully moved to a different node on a file server cluster. File server cluster name: %4 New file server cluster address: %6!S! Guidance: Continuous Availability (Transparent Failover) is in use and the client computer successfully moved to a different node after an SMB witness request over RPC using TCP (first contacting port 135, then contacting an endpoint port above 1023). No user action is required.
0xb002786611Failed to establish an SMB multichannel network connection. Error: %2 Server name: %4 Server address: %6!S! Client address: %7!S! Instance name: %9 Connection type: %10 Port origin:%11 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks the TCP or UDP port listed in the Server Address field can also cause this issue. Since the error occurred while trying to connect extra channels, it will not result in an application error. This event is for diagnostics only.
0xb002786711The connection was terminated due to one or more IO request timeouts. Error: %2 Name: %4 Server address: %6!S! Client address: %7!S! Instance name: %9 Connection type: %10 Guidance: This indicates a problem with the underlying network or the storage stack on the remote server. IO operations were not completed within the allotted time. The application may not see this failure because IOs are usually retried on a different connection. This event is for diagnostics only.
0xb002786e11The SMB redirector selected the connection initiated with the following parameters: Server name: %2 Server socket address: %5 Client socket address: %7 Connection ID: %13 Client certificate thumbprint: %15 Transport: %3 Instance Name: %9 Port Origin: %10
0xb002786f11The SMB client was denied access to the SMB server during mutual authentication. Server name: %2 Server socket address: %5 Client socket address: %7 Connection ID: %12 Client certificate thumbprint: %14 Transport: %3 Instance Name: %9 Port Origin: %10
0xb002792511The signing validation failed. Error:%7 Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Server address: %13!S! Client address: %15!S! Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt. PacketFragment:%9
0xb002792611The client received an unencrypted message when encryption was expected. Server name: %6 Session ID:%3 Tree ID:%4 Message ID:%2 Command: %1 Instance Name: %9 Server address: %13!S! Client address: %15!S! Guidance: This error indicates that SMB messages are being modified in transit across the network from the server to the client. This may be due to the session ending on the server, a problem with the network, a problem with a third-party SMB server, or a "adversary-in-the-middle" compromise attempt.
0xb003785311Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6!S! Instance name: %9 Connection type: %10 Port origin: %11 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks the TCP or UDP port listed in the Server Address field can also cause this issue.
0xb003785611The client re-established its session to the server. Server name: %5 Server address: %7!S! Session ID: %2 Signing used: %8 Encryption used: %9 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.
0xb003785811The connection to the share was re-established. Share name: %5 Server address: %7!S! Session ID: %2 Tree ID: %3 Signing used: %8 Encryption used: %9 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.
0xb004785311Failed to establish a network connection. Error: %2 Server name: %4 Server address: %6!S! Instance name: %9 Connection type: %10 Port origin: %11 Connection ID: %13 Client certificate thumbprint: %15 Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks the TCP or UDP port listed in the Server Address field can also cause this issue.
0xb004785811The connection to the share was re-established. Share name: %5 Server address: %7!S! Session ID: %2 Tree ID: %3 Transport type: %8 Signing used: %9 Encryption used: %10 Compression requested: %11 NTLM blocked: %12 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.
0xd000000a11NetBT
0xd000000b11TCPIP
0xd000001b11Smb2DiagReasonQuicServerCertificateValidationError
0xd000001c11Smb2DiagReasonAcquireCredHandle
0xd000001d11Smb2DiagReasonISC
0xd000001e11Smb2DiagReasonSessionSetupResponse
0xd000001f11Smb2DiagReasonMADowngrade
0xd000002011Smb2DiagReasonCreateSigningKey
0xd000002111Smb2DiagReasonRegisterCryptoKeys
0xd000002211Smb2DiagReasonQCA
0xd000002311Smb2DiagReasonEncryptionOnNullSession
0xd000002411Smb2DiagReasonSessionKeyLength
0xd000002511Smb2DiagReasonTreeConnectResponse
0xd000002611Smb2DiagReasonValidateNegotiateFsctl
0xd000002711Smb2DiagReasonHandleReconnect
0xd000002811Smb2DiagReasonCreateResponse
0xd000002911Smb2DiagReasonExchangeCancellation
0xd000002a11Smb2DiagReasonExchangeNoBindingObject
0xd000002b11Smb2DiagReasonExchangeSendFailure
0xd000002c11Smb2DiagReasonObjectSuspended
0xd000002d11Smb2DiagReasonUserDisconnect
0xd000002e11Smb2DiagReasonHandleClosed
0xd000002f11Smb2DiagReasonInternalError
0xd000003011Smb2DiagDisconnectReasonReceiveContextAllocation
0xd000003111Smb2DiagDisconnectReasonPaddingAllocation
0xd000003211Smb2DiagDisconnectReasonExchangeReceiveHandlerError
0xd000003311Smb2DiagDisconnectReasonMessageBufferAllocation
0xd000003411Smb2DiagDisconnectReasonVcEndpointTornDown
0xd000003511Smb2DiagDisconnectReasonMessageSizeReceiveError
0xd000003611Smb2DiagDisconnectReasonMessageSizeTooLargeError
0xd000003711Smb2DiagDisconnectReasonMessageCopyError
0xd000003811Smb2DiagDisconnectReasonVcReceiveHandlerError
0xd000003911Smb2DiagDisconnectReasonVcReceiveError
0xd000003a11Negotiate
0xd000003b11Session setup
0xd000003c11Logoff
0xd000003d11Tree connect
0xd000003e11Tree disconnect
0xd000003f11Create
0xd000004011Close
0xd000004111Flush
0xd000004211Read
0xd000004311Write
0xd000004411Lock
0xd000004511Ioctl
0xd000004611Cancel
0xd000004711Echo
0xd000004811Query directory
0xd000004911Change notify
0xd000004a11Query info
0xd000004b11Set info
0xd000004c11Oplock break
0xd000004d11Create
0xd000004e11Close
0xd000004f11Read
0xd000005011Write
0xd000005111Query information
0xd000005211Set information
0xd000005311Query EA
0xd000005411Set EA
0xd000005511Flush buffers
0xd000005611Query volume information
0xd000005711Set volume information
0xd000005811Directory control
0xd000005911File system control
0xd000005a11Device control
0xd000005b11Internal device control
0xd000005c11Lock control
0xd000005d11Cleanup
0xd000005e11Query security
0xd000005f11Set security
0xd000006011Query quota information
0xd000006111Set quota information
0xd000006211Internal probe I/O
0xd000006311Symmetric
0xd000006411Asymmetric
0xd000006511None
0xd000006611NTLM
0xd000006711Kerberos
0xd000006811PKU2U
0xd000006911RDR_PRIMARY_INSTANCE
0xd000006a11RDR_CSV_INSTANCE
0xd000006b11RDR_SBL_INSTANCE
0xd000006c11RDR_SR_INSTANCE
0xd000006d11Security Transforms Disabled
0xd000006e11Security Transforms Enabled
0xd000006f11Security Transforms Enabled (Except For Shares Enabled With Isolated Transport)
0xd000007011The port was not selected for this transport.
0xd000007111The port was selected from the registry mapping.
0xd000007211The port was selected from net use parameters.
0xd000007311The port was selected from the device instance's configuration.
0xd000007411The port was selected from the global registry settings.
0xd000007511The port was selected from the policy mapping.
0xd000007611InitializeSecurityContextW
0xd000007711AcquireCredentialsHandleW
0xf000000111Supports RDMA via SMBDirect
0xf000000211Supports runtime unlinking from SMBDirect
604 entries