Windows System event log
Classic Windows Event Log System channel, the OS core. Covers storage corruption and disk errors, the crash and reboot trail (Kernel-Power 41, bugcheck 1001, EventLog 6008), Service Control Manager install and crash events, WHEA hardware errors, DCOM failures, Hyper-V vSwitch changes, and IIS/WAS plus Failover Clustering spillover. Nothing is deleted: high-volume chatter is retained at the Debug severity tier. Some events state a severity that does not match their real impact; the stored severity is authoritative, and severity_original keeps the event's own value when the two differ.
Feed id: win.eventlog.system.
Channels
This feed reads one Windows Event Log channel, System.
Curated reasons
Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.
| Reason | Ticket class | Severity |
|---|---|---|
av_unsigned_code_blocked | endpoint_protection | Serious |
bugcheck | os_stability | Serious (server or unknown) / Error (workstation) |
cluster_csv_unavailable | clustering | Severe |
cluster_node_removed | clustering | Serious |
cluster_quorum_loss | clustering | Severe |
cluster_resource_failed | clustering | Serious |
cluster_resource_hang | clustering | Serious |
cluster_rhs_crash | clustering | Serious |
cluster_service_down | clustering | Severe |
dcom_activation_timeout | app_stability | Minor |
dcom_register_timeout | app_stability | Minor |
dcom_start_error | app_stability | Minor |
disk_bad_block | storage | Serious |
disk_controller_error | storage | Error |
disk_corruption | storage | Critical |
disk_io_retried | storage | Warning |
disk_paging_error | storage | Warning |
disk_surprise_removal | storage | Warning |
driver_load_failed | hardware | Warning |
ephemeral_port_alloc_failed | networking | Notice |
firmware_attack_indicator_reported | endpoint_protection | Error or Warning |
gpu_driver_reset | hardware | Notice |
hardware_error_corrected | hardware | Notice |
hardware_error_uncorrected | hardware | Error |
http_ssl_binding_created | certificates | Notice |
http_ssl_binding_deleted | certificates | Notice |
http_ssl_config_failed | certificates | Error |
iis_apppool_disabled | web | Serious (server or unknown) / Warning (workstation) |
iis_apppool_failed | web | Error or Warning |
iis_worker_crash | web | Warning |
kerberos_cert_domain_unresolved | auth | Info (capped) |
kerberos_etype_unsupported | auth | Warning |
kerberos_pac_verify_failed | auth | Warning |
kerberos_smartcard_cert_missing | auth | Warning |
kerberos_weak_krbtgt_key | auth | Warning |
nic_driver_fault_reported | networking | Warning |
nic_driver_load_failed | networking | Error |
nic_link_down | networking | Warning |
nic_link_up | networking | Info |
ntfs_corruption | storage | Critical (corrupted MFT record, MFT torn write, volume cannot be corrected) / Serious (corruption in a directory index or another structure) / Error (torn write on a data file) / Warning (repair completed, repair posting throttled) |
ntfs_delayed_write_lost | storage | Serious (path on the system volume) / Error (path anywhere else) |
ntfs_transaction_log_error | storage | Warning (flush failed on a live volume, recovery error, metadata reset) / Notice (flush failed on a volume that no longer exists) / Error (resource manager could not start) |
patch_install_failed | patching | Minor, Info or Verbose |
rds_license_server_unactivated | licensing | Warning |
rds_license_tracking_failed | licensing | Warning |
rds_licensing_service_failed | licensing | Error |
secure_boot_cert_update_pending | hardware | Warning |
security_agent_service_start_failed | endpoint_protection | Warning |
security_agent_service_terminated | endpoint_protection | Minor |
service_crashed | app_stability | Error |
service_exited_error | app_stability | Error |
service_hang | app_stability | Error |
service_installed | security_audit | Notice |
service_start_failed | app_stability | Error |
service_start_timeout | app_stability | Error |
smb_delayed_write_lost | storage | Error |
smb_server_transport_bind_failed | networking | Warning (server) / Info (workstation) |
smb_share_recreate_failed | storage | Warning |
storage_controller_reset | storage | Error |
time_sync_failed | time_sync | Warning |
tls_cert_expired | certificates | Error |
tls_cert_name_mismatch | certificates | Error |
tls_cert_untrusted_ca | certificates | Error |
tls_cipher_mismatch | certificates | Warning |
tls_client_credential_failed | certificates | Error (server) / Warning (workstation) |
tls_server_credential_failed | certificates | Error |
tpm_attestation_failed | hardware | Error |
unexpected_shutdown | os_stability | Serious or Error on a server or an unknown host class, depending on which record reports it and what level that record carried; Warning on a workstation. |
vpn_connected | vpn | Notice |
vss_shadow_aborted | backup | Error or Warning |
vss_shadow_lost | backup | Error |
vswitch_config_restore_failed | virtualization | Error or Warning (server or unknown) / Info (workstation) |
win_app_error_dialog_shown | app_stability | Minor |
winre_servicing_failed | patching | Error |
wlan_limited_connectivity | networking | Warning |
av_unsigned_code_blocked
A security agent blocked a process whose image contained unsigned or corrupted code from performing a privileged operation.
Severity: Serious
Impact: The privileged operation did not happen, so nothing on the host changed. What the event establishes is that a binary running on this machine fails a code-integrity check.
Channel: System
Provider: mfehidk
Event ids: 514
Where to look next:
- Identify the named executable and confirm whether it is expected on this host.
- Check whether the same executable appears on other hosts in the fleet.
- A legitimate application with a stripped or broken signature produces this line too.
Related reasons:
av_threat_detected: a named threat rather than a code-integrity failure
bugcheck
Windows rebooted from a bugcheck.
Severity: Serious (server or unknown) / Error (workstation)
Impact: The host crashed and rebooted; the dump may be needed for driver, hardware, or kernel analysis.
Channel: System
Provider: Microsoft-Windows-WER-SystemErrorReporting
Event ids: 1001
Where to look next:
- Preserve the dump path and bugcheck code.
- Correlate with Kernel-Power 41 and EventLog 6008.
Fields it can set: win.eventlog.system.bugcheck_text, win.eventlog.system.dump_file, win.eventlog.system.report_id
cluster_csv_unavailable
A Cluster Shared Volume became unavailable or paused.
Severity: Severe
Impact: Clustered workloads using the CSV may lose storage access or degrade until the volume recovers.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 5120, 5142
Where to look next:
- Identify the CSV and owning node.
- Check storage, network, and redirected-access state.
cluster_node_removed
A failover cluster node was removed from active membership.
Severity: Serious
Impact: Cluster capacity or availability may be reduced, and workloads may fail over or become degraded.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1135
Where to look next:
- Identify the node and reason in the event body.
- Check network, heartbeat, and quorum events around the removal.
cluster_quorum_loss
The failover cluster lost quorum or its quorum resource.
Severity: Severe
Impact: The cluster may stop services or be unable to make safe failover decisions.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1561
Where to look next:
- Review quorum configuration, including the quorum resource.
- Check node and network reachability.
cluster_resource_failed
A failover cluster resource failed.
Severity: Serious
Impact: A clustered workload or dependency may be offline, failed over, or degraded.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1069
Where to look next:
- Identify the resource and group.
- Check whether the resource recovered or failed over.
cluster_resource_hang
A clustered resource became unresponsive and was terminated.
Severity: Serious
Impact: The workload can become unavailable or fail over while the cluster recovers the resource.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1230
Where to look next:
- Identify the resource and owning node.
- Check whether termination was followed by successful restart or failover.
cluster_rhs_crash
The cluster Resource Hosting Subsystem crashed.
Severity: Serious
Impact: Cluster resource monitoring or hosting may be disrupted, causing dependent resources to fail or restart.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1146
Where to look next:
- Check resource DLLs and the resource hosted by RHS.
- Look for paired resource failure events.
cluster_service_down
The cluster service stopped or was forced down.
Severity: Severe
Impact: Cluster coordination may be unavailable, risking workload outage or preventing failover.
Channel: System
Provider: Microsoft-Windows-FailoverClustering
Event ids: 1006, 1073, 1177
Where to look next:
- Check quorum state and node membership.
- Correlate with node removal and quorum-loss events.
dcom_activation_timeout
DCOM activation timed out.
Severity: Minor
Impact: The requested COM application may be unavailable or stuck during activation.
Channel: System
Provider: Microsoft-Windows-DistributedCOM
Event ids: 10029
Where to look next:
- Resolve the CLSID/AppID where present.
- Correlate with service control and application errors.
dcom_register_timeout
A DCOM server did not register in time.
Severity: Minor
Impact: The COM server or application may be hung, unavailable, or too slow to start.
Channel: System
Provider: Microsoft-Windows-DistributedCOM
Event ids: 10010
Where to look next:
- Use the CLSID to identify the application.
- Check adjacent service start or application error events.
Fields it can set: win.eventlog.system.clsid
dcom_start_error
DCOM failed while starting an application or service.
Severity: Minor
Impact: The COM-backed application may fail to launch or serve dependent callers.
Channel: System
Provider: Microsoft-Windows-DistributedCOM
Event ids: 10005
Where to look next:
- Identify the named service or server from the event body.
- Check SCM errors for the same service.
disk_bad_block
A disk reported a bad block.
Severity: Serious
Impact: Data in the affected block may be unreadable, and the drive is consuming its spare-block reserve.
Channel: System
Provider: disk
Event ids: 7
Where to look next:
- Read the device path from the message and check the drive's health counters.
- Plan replacement rather than repair: bad blocks do not heal.
Related reasons:
disk_corruption: damage found in the file system on the volume, a different layer and a different fixdisk_io_retried: an IO that recovered after a retry
disk_controller_error
A disk controller error was reported for a storage device.
Severity: Error
Impact: Repeated controller errors can precede disk, cabling, controller, or removable-media failure.
Channel: System
Provider: disk
Event ids: 11
Where to look next:
- Check whether the device path maps to a fixed disk or removable media.
- Correlate with disk_io_retried, disk_paging_error, and NTFS corruption on the same device.
disk_corruption
The disk provider reported file-system corruption.
Severity: Critical
Impact: Data integrity is at risk; repair may require chkdsk, restore, or storage replacement work.
Channel: System
Provider: disk
Event ids: 55
Where to look next:
- Prioritize volume identification and recent backup state.
- Correlate with ntfs_corruption and unexpected shutdown records.
disk_io_retried
A disk IO operation had to be retried.
Severity: Warning
Impact: Retries can add latency and may indicate a degrading disk, cable, controller, or transient removable-device issue.
Channel: System
Provider: disk
Event ids: 153
Where to look next:
- Check recurrence per device.
- Correlate with paging errors or controller resets.
disk_paging_error
Windows reported a disk error during a paging operation.
Severity: Warning
Impact: The affected device may be slow, unstable, or disconnecting under IO pressure.
Channel: System
Provider: disk
Event ids: 51
Where to look next:
- Pivot on the device path in the raw event message.
- Look for adjacent controller reset or retry events.
disk_surprise_removal
A disk disappeared without an orderly removal path.
Severity: Warning
Impact: Unexpected removal can interrupt IO and may corrupt open files or workloads using the device.
Channel: System
Provider: disk
Event ids: 157
Where to look next:
- Identify whether the device is USB, virtual, or fixed storage.
- Check adjacent service or backup failures that used the disk.
driver_load_failed
A device driver failed to load.
Severity: Warning
Impact: The device may be unavailable, degraded, or missing expected driver functionality.
Channel: System
Provider: Microsoft-Windows-Kernel-PnP
Event ids: 219
Where to look next:
- Review driver_name, device_instance, and ntstatus.
- Check Device Manager or driver updates for the same device instance.
Fields it can set: win.eventlog.system.device_instance, win.eventlog.system.driver_name, win.eventlog.system.ntstatus
ephemeral_port_alloc_failed
A local port could not be allocated from the ephemeral port range.
Severity: Notice
Impact: One outbound connection attempt failed at that moment. A sustained rate means the device runs out of local ports, which breaks new connections across every application on the host.
Channel: System
Provider: Tcpip
Event ids: 4231, 4266
Where to look next:
- Check the rate over time rather than the single event.
- Look for an application leaking sockets, or a port range narrowed by configuration.
A single occurrence is common and self-correcting. The actionable form is a sustained rate on one device.
firmware_attack_indicator_reported
A firmware-security agent reported an Indicator of Attack against this machine platform.
Severity: Error or Warning
Impact: The platform is in the state the indicator names, which normally means a firmware protection is disabled or the chassis was opened. Where the indicator completed, the agent considers its pattern met.
Channel: System
Provider: Dell Trusted Device | BIOS Events and IoA
Event ids: 11, 12
| Case | Severity | Ticket class |
|---|---|---|
partial | Warning | endpoint_protection |
escalated | Error | endpoint_protection |
Where to look next:
- Read the Category and the listed events from the message: they name what was matched.
- Check whether a deliberate BIOS change or a hardware service visit explains it.
- Where nothing explains it, treat the named firmware settings as the thing to put back.
Related reasons:
av_unsigned_code_blocked: an endpoint agent blocking code it could not verify
gpu_driver_reset
The NVIDIA display driver reset.
Severity: Notice
Impact: GPU resets can interrupt interactive sessions, remote desktop, rendering, or GPU-backed workloads.
Channel: System
Provider: nvlddmkm
Event ids: 153
Where to look next:
- Check display driver version and recent GPU load.
- Correlate with application hangs or desktop session resets.
- Check for an adjacent driver install: an upgrade resets the display stack and is expected.
- Repetition WITHOUT a driver install is the real signal; a single reset usually is not.
hardware_error_corrected
Windows Hardware Error Architecture reported a CORRECTED hardware error.
Severity: Notice
Impact: No consequence yet: the hardware caught the fault. Recurrence is early warning for marginal hardware (memory, PCIe links).
Channel: System
Provider: Microsoft-Windows-WHEA-Logger
Event ids: 17, 19
Where to look next:
- Track recurrence by error_source and device_instance.
- A burst after a driver or firmware change points at the change, not the silicon.
Related reasons:
hardware_error_uncorrected: the same error sources when correction fails
Fields it can set: win.eventlog.system.device_instance, win.eventlog.system.error_source
hardware_error_uncorrected
Windows Hardware Error Architecture reported an UNCORRECTED hardware error.
Severity: Error
Impact: The fault was not contained: data loss, corruption, or a crash may follow. Treat as a hardware incident, not a log curiosity.
Channel: System
Provider: Microsoft-Windows-WHEA-Logger
Event ids: 18, 20
Where to look next:
- Track recurrence by error_source and device_instance.
- Correlate with subsequent bugchecks or disk errors on the same host.
Related reasons:
hardware_error_corrected: the same error sources when the hardware catches the fault
Fields it can set: win.eventlog.system.device_instance, win.eventlog.system.error_source
http_ssl_binding_created
An HTTPS certificate binding was created for a listener endpoint on this host.
Severity: Notice
Impact: The endpoint can serve HTTPS with the bound certificate. Routine after an installation or a certificate replacement.
Channel: System
Provider: Microsoft-Windows-HttpService, Microsoft-Windows-HttpEvent
Event ids: 120, 15301
Where to look next:
- Read the endpoint from the message: an address and port, or a host name and port.
- A creation shortly after a deletion for the same endpoint is a certificate replacement.
- The modern record also names the process and the account that made the change.
Related reasons:
http_ssl_binding_deleted: the same binding table losing an endpointhttp_ssl_config_failed: a binding that exists but cannot be used
http_ssl_binding_deleted
The HTTPS certificate binding for a listener endpoint was removed on this host.
Severity: Notice
Impact: Clients reaching that endpoint over HTTPS get no certificate until a binding is put back. This is routine during an uninstall or the first half of a certificate replacement.
Channel: System
Provider: Microsoft-Windows-HttpService, Microsoft-Windows-HttpEvent
Event ids: 119, 15300
Where to look next:
- Read the endpoint from the message: an address and port, or a host name and port.
- Check whether a creation record for the same endpoint follows, which is what a certificate replacement looks like.
- The modern record also names the process and the account that made the change.
Related reasons:
http_ssl_binding_created: the same binding table gaining an endpointhttp_ssl_config_failed: a binding that exists but cannot be used
http_ssl_config_failed
An HTTPS listener endpoint on this host could not use its SSL configuration.
Severity: Error
Impact: Clients connecting to that endpoint over HTTPS fail the TLS handshake until the binding or the certificate behind it is fixed.
Channel: System
Provider: Microsoft-Windows-HttpEvent
Event ids: 15021
Where to look next:
- Read the endpoint from the message, then list the certificate bindings for it.
- Check whether the bound certificate is still in the store and still valid.
- Check that the service account can read the private key of the bound certificate.
Related reasons:
http_ssl_binding_deleted: the binding for an endpoint being removed outrighttls_cert_expired: a certificate this host presented having passed its validity period
iis_apppool_disabled
An IIS application pool was disabled by rapid-fail protection.
Severity: Serious (server or unknown) / Warning (workstation)
Impact: The application pool can return 503 responses until an operator fixes and re-enables it.
Channel: System
Provider: Microsoft-Windows-WAS
Event ids: 5002
Where to look next:
- Identify the application pool.
- Check preceding worker crashes or startup failures.
iis_apppool_failed
IIS reported an application pool worker, configuration, or mapping failure.
Severity: Error or Warning
Impact: The affected web application may fail to start, serve requests, or map correctly.
Channel: System
Provider: Microsoft-Windows-WAS
Event ids: 5009, 5021, 5057, 5059
Where to look next:
- Resolve the exact WAS event id and message.
- Correlate with IIS worker crashes and HTTP 503 reports.
iis_worker_crash
An IIS worker process terminated unexpectedly.
Severity: Warning
Impact: Requests handled by that worker may fail or reset; repeated crashes can degrade the site or app pool.
Channel: System
Provider: Microsoft-Windows-WAS
Event ids: 5011
Where to look next:
- Identify the application pool and worker process.
- Correlate with Application-channel crash events.
kerberos_cert_domain_unresolved
Kerberos could not resolve the domain named in a certificate offered for sign-in.
Severity: Info (capped)
Impact: On a domain-joined device, certificate or smart-card sign-in for that domain does not complete. On a cloud-joined or standalone device the same message is routine and expected.
Channel: System
Provider: Microsoft-Windows-Security-Kerberos
Event ids: 11
Where to look next:
- Confirm whether the device is joined to the domain named in the certificate.
- On domain-joined devices, check domain controller reachability and DNS from this host.
The same code path serves physical smart cards, virtual smart cards and Windows Hello for Business, so the message is not evidence that a physical card is in use.
kerberos_etype_unsupported
A Kerberos exchange failed because the encryption types the client, the service account and the domain controller support do not overlap.
Severity: Warning
Impact: The affected client or service cannot obtain the ticket it asked for and falls back or fails. Accounts left in this state stop authenticating once the legacy encryption types are refused outright.
Channel: System
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
Event ids: 16, 203
Where to look next:
- Read the account and the requested encryption types from the message.
- Set the supported encryption types on the service account, or reset its password so a modern key is generated.
- Identify legacy clients and appliances before the weak types are refused outright.
Related reasons:
kerberos_ticket_failed: the client-side record of a ticket request that did not succeedkerberos_weak_krbtgt_key: the same legacy-cryptography problem on the ticket-granting account itself
kerberos_pac_verify_failed
A domain controller could not verify the signature on the privilege data inside a Kerberos ticket.
Severity: Warning
Impact: The request carrying that ticket did not proceed. A client presenting the same ticket repeatedly keeps failing to authenticate to the affected service.
Channel: System
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
Event ids: 18
Where to look next:
- Compare the update level of every domain controller in the domain before reading this as an attack.
- Note which account the message names and whether the pattern follows one client or many.
Related reasons:
kerberos_etype_unsupported: another Kerberos exchange failure, over encryption types rather than signatures
kerberos_smartcard_cert_missing
A domain controller has no usable certificate for smart card logon.
Severity: Warning
Impact: Certificate-based logon does not work against this domain controller. Other authentication methods are unaffected.
Channel: System
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
Event ids: 19, 29
Where to look next:
- Confirm whether smart card or certificate logon is in use in this domain before acting.
- Check the domain controller certificate template, its enrolment, and the chain to the issuing authority.
Related reasons:
cert_enroll_failed: the enrolment failure that leaves a controller without its certificatekerberos_cert_domain_unresolved: the client-side half of a certificate logon that could not proceed
kerberos_weak_krbtgt_key
The domain ticket-granting account has no strong encryption key, so Kerberos tickets are issued using legacy cryptography.
Severity: Warning
Impact: Domain authentication is protected by weaker cryptography than it should be, and the domain stops issuing usable tickets once the legacy encryption types are refused.
Channel: System
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
Event ids: 42
Where to look next:
- The remedy is a password update on the ticket-granting account, performed the documented way.
- Plan it before legacy encryption types are refused outright.
Related reasons:
kerberos_etype_unsupported: the same legacy-cryptography problem on ordinary service accounts
nic_driver_fault_reported
A loaded wireless network adapter driver reported a fault in the adapter or in itself.
Severity: Warning
Impact: Wireless connectivity on that adapter is lost or unreliable for as long as the fault lasts. The driver normally resets and reloads itself without anyone acting.
Channel: System
Provider: Intel wireless NDIS miniports (Netwtw* and Netwaw* adapter generations)
Event ids: 5002, 5005
Where to look next:
- Check whether the driver wrote an initialization record afterwards, which means it recovered.
- Repeats on one host point at the adapter, its firmware or the driver version.
Related reasons:
nic_driver_load_failed: the driver failing to load at all, which no reset recoversnic_link_down: a working adapter reporting its link lost, which is a different factwlan_limited_connectivity: the Windows wireless service reporting the connection degraded
nic_driver_load_failed
A wireless network adapter driver could not load, normally because of a resource conflict.
Severity: Error
Impact: The adapter is absent from the network stack until it is fixed. Nothing on the host retries the load.
Channel: System
Provider: Intel wireless NDIS miniports (Netwtw* and Netwaw* adapter generations)
Event ids: 5000
Where to look next:
- A driver that could not load is normally a resource conflict, a disabled device or a bad install.
- Check whether the host has another adapter carrying its traffic.
Related reasons:
driver_load_failed: the same class of failure for drivers outside this adapter familynic_driver_fault_reported: a loaded driver reporting a fault, which normally resets itselfnic_link_down: a working adapter reporting its link lost, which is a different fact
nic_link_down
A network adapter reported that its link went down.
Severity: Warning
Impact: Traffic on that adapter stops until the link returns. A host with another working adapter stays reachable; a host with only this one is offline for the duration.
Channel: System
Provider: Intel NDIS miniports (e1i68x64 and the sibling adapter generations, e2fnexpress), bnxtnd
Event ids: 2, 27
Where to look next:
- Look for the matching link-up record and read the gap between them.
- Repeated drop-and-return cycles on one adapter point at the cable, the port or the switch.
Related reasons:
nic_driver_fault_reported: the driver reporting a fault in itself rather than a state of the linknic_link_up: the same adapter reporting the link back, which is what makes a drop readable
nic_link_up
A network adapter reported that its link came up.
Severity: Info
Channel: System
Provider: Intel NDIS miniports (e1i68x64 and the sibling adapter generations, e2fnexpress), bnxtnd
Event ids: 9, 14, 32
Where to look next:
- Read it beside the matching link-down record to size the outage on that adapter.
- A negotiated rate below the port capability is worth a look at the cable and the switch port.
Related reasons:
nic_link_down: the same adapter reporting the link lost
ntfs_corruption
NTFS found damage in the structures on a volume, or reported repairing it.
Severity: Critical (corrupted MFT record, MFT torn write, volume cannot be corrected) / Serious (corruption in a directory index or another structure) / Error (torn write on a data file) / Warning (repair completed, repair posting throttled)
Impact: Volume integrity is at risk; applications and files on that volume may be affected until repair is complete. Damage to the Master File Table reaches every file on the volume, because it holds the record of where each of them lives.
Channel: System
Provider: Ntfs, Microsoft-Windows-Ntfs
Event ids: 7, 55, 130, 131, 132, 133
| Case | Severity | Ticket class |
|---|---|---|
corruption_discovered | Serious to Critical | storage |
correction_required | Critical | storage |
torn_write_detected | Error to Critical | storage |
repair_activity | Warning | storage |
repair_posting_throttled | Warning | storage |
Where to look next:
- Identify the volume from structured fields or message text, and read which structure the message names.
- For Master File Table damage or a volume that cannot be corrected, plan an offline chkdsk and check backup state first.
- Check whether chkdsk or storage diagnostics completed after the event.
- Read the rate as well as the instance: repeated repairs on one volume point at the device.
Related reasons:
ntfs_transaction_log_error: the NTFS transaction log failing, a different fact with a different fix
Fields it can set: win.eventlog.system.volume
ntfs_delayed_write_lost
Windows could not save cached file data to the volume and the data was lost.
Severity: Serious (path on the system volume) / Error (path anywhere else)
Impact: Data an application believed it had written was discarded. The application is not told. Repeated occurrences point at the connection to the storage device rather than at the file system.
Channel: System
Provider: Ntfs
Event ids: 50
Where to look next:
- Check the path to the device: cabling, controller, and for network or removable volumes the link.
- Read the rate rather than one instance: a steady stream means the storage path is still failing.
Related reasons:
ntfs_corruption: damage found in on-disk structures, a different fact with a different fixsmb_delayed_write_lost: the same loss reported by the SMB client for a file on a network share
Fields it can set: win.eventlog.system.volume
ntfs_transaction_log_error
The NTFS transaction log on a volume could not be written, replayed, or brought up.
Severity: Warning (flush failed on a live volume, recovery error, metadata reset) / Notice (flush failed on a volume that no longer exists) / Error (resource manager could not start)
Impact: NTFS uses the transaction log to undo changes that did not finish. While it is unavailable, a change interrupted on that volume may be left half applied.
Channel: System
Provider: Ntfs, Microsoft-Windows-Ntfs, NTFS
Event ids: 134, 136, 137, 140
| Case | Severity | Ticket class |
|---|---|---|
flush_failed | Notice to Warning | storage |
recovery_error | Warning | storage |
metadata_reset | Warning | storage |
start_failed | Error | storage |
Where to look next:
- Identify the volume, and check whether it is still present on the host.
- For a live volume, check the path to the device and whether the host was under memory pressure.
Related reasons:
ntfs_corruption: damage found in on-disk structures, answered with a volume repairntfs_delayed_write_lost: cached file data discarded before it reached the volume
Fields it can set: win.eventlog.system.volume
patch_install_failed
Windows Update reports the outcome of an update install attempt on this device.
Severity: Minor, Info or Verbose
Impact: On a failure the device stays on the previous version of that update until a later attempt succeeds, and repeated failures on the same update mean the device is falling behind on patching. On the deferred and did-not-run outcomes nothing changed and the update is offered again.
Channel: System
Provider: Microsoft-Windows-WindowsUpdateClient
Event ids: 20
| Case | Severity | Ticket class |
|---|---|---|
packages_in_use | Verbose | patching |
retry_later | Info | patching |
interrupted | Info | patching |
failed | Minor | patching |
Where to look next:
- Check whether a later attempt at the same update succeeded.
- Group by the update title across the fleet to separate a bad update from a device problem.
- Group by the result code to separate one failure cause from another.
Fields it can set: win.eventlog.system.update_title
A single failure is common and usually self-correcting. Recurrence across cycles on the same update is the actionable pattern. The update title and the result code ride the message tail, and the normalized code and its space ride the shared error fields.
rds_license_server_unactivated
A Remote Desktop license server is not activated and is issuing only temporary licences.
Severity: Warning
Impact: Remote Desktop clients receive temporary licences that expire. Once they do, sessions are refused until the license server is activated.
Channel: System
Provider: Microsoft-Windows-TerminalServices-Licensing
Event ids: 18
Where to look next:
- Activate the license server named in the message through its own management console.
- Check which licence model and how many licences the server is configured for while there.
Related reasons:
rds_license_tracking_failed: the license server unable to record licence issue in the directoryrds_licensing_service_failed: the same license server unable to run at all
rds_license_tracking_failed
A Remote Desktop license server could not record a per-user licence in the directory.
Severity: Warning
Impact: Per-user licence tracking is incomplete for the affected users. Sessions still work, so the gap is only visible when licence usage is audited.
Channel: System
Provider: Microsoft-Windows-TerminalServices-Licensing
Event ids: 4105
Where to look next:
- Add the license server computer account to the licence-servers group the message names.
- Re-check licence usage reporting afterwards, since earlier issues were not recorded.
Related reasons:
rds_license_server_unactivated: the same server issuing only temporary licences
rds_licensing_service_failed
A Remote Desktop license server could not run, or hit an error in its licensing database.
Severity: Error
Impact: New Remote Desktop client access licences are not being issued reliably by this server. Existing licences keep working until they expire.
Channel: System
Provider: Microsoft-Windows-TerminalServices-Licensing
Event ids: 37, 44, 4097
| Case | Severity | Ticket class |
|---|---|---|
start_failed | Error | licensing |
database_error | Error | licensing |
Where to look next:
- Read the error the message names before restarting anything.
- Check whether the deployment has a second license server still answering.
- A database engine error normally means the licensing store needs repair or rebuild.
Related reasons:
rds_license_server_unactivated: a license server that runs but issues only temporary licencesrds_license_tracking_failed: a license server unable to record licence issue in the directory
secure_boot_cert_update_pending
A Secure Boot certificate update has not been applied on this device.
Severity: Warning
Impact: Boot trust material stays stale, which can block future firmware or OS updates and leave the device on superseded Secure Boot certificates.
Channel: System
Provider: Microsoft-Windows-TPM-WMI
Event ids: 1801
Where to look next:
- Check pending firmware and servicing updates on the device.
- Confirm Secure Boot state after the next update cycle.
Related reasons:
tpm_attestation_failed: Same provider; device trust and firmware posture
security_agent_service_start_failed
A sub-service of an endpoint protection agent failed to start.
Severity: Warning
Impact: The named component of the security product is not running. Where the component belongs to this installation, the agent is operating without part of its function.
Channel: System
Provider: McAfee Service Controller
Event ids: 6
Where to look next:
- Read the reason the supervisor states; a missing file is usually a component this edition does not ship.
- Confirm from the product console whether the named component is expected on this host.
Related reasons:
security_agent_service_terminated: the same supervisor reporting a component that died while runningservice_start_failed: the Windows service controller reporting the same class of failure
security_agent_service_terminated
A sub-service of an endpoint protection agent terminated unexpectedly.
Severity: Minor
Impact: The named component of the security product stopped. The agent normally restarts it, so a single occurrence usually leaves protection intact; a host emitting these continuously is running a broken install.
Channel: System
Provider: McAfee Service Controller
Event ids: 5
Where to look next:
- Count occurrences per host: the rate is the signal, not one event.
- Name the sub-service from the message and check whether it is expected on this build.
- A host looping on this normally needs the agent reinstalled.
Related reasons:
security_agent_service_start_failed: the same supervisor reporting a component that never startedservice_crashed: the Windows service controller reporting the same class of failure
service_crashed
A Windows service crashed or terminated unexpectedly.
Severity: Error
Impact: The service may be unavailable, degraded, or flapping until it restarts cleanly.
Channel: System
Provider: Service Control Manager
Event ids: 7031, 7034
Where to look next:
- Group by service_name and crash_count.
- Look for vendor service names that point to backup, RMM, security, or line-of-business software.
Fields it can set: win.eventlog.system.crash_count, win.eventlog.system.service_name
service_exited_error
A Windows service exited with an error.
Severity: Error
Impact: The affected service may not be delivering its role until the underlying service error is fixed.
Channel: System
Provider: Service Control Manager
Event ids: 7023, 7024
Where to look next:
- Record the service-specific error code or message.
- Check whether a later start succeeded.
Fields it can set: win.eventlog.system.service_error, win.eventlog.system.service_name
service_hang
A Windows service stopped responding to a control transaction.
Severity: Error
Impact: A hung service can block dependent work or delay shutdown, startup, or control operations.
Channel: System
Provider: Service Control Manager
Event ids: 7011
Where to look next:
- Identify the named service and transaction timeout.
- Check for adjacent service crashes or resource pressure.
Fields it can set: win.eventlog.system.service_name
service_installed
A Windows service was installed.
Severity: Notice
Impact: Unexpected service creation can establish persistence or run code under a privileged account.
Channel: System
Provider: Service Control Manager
Event ids: 7045
Example
A service was installed in the system.
channel: System
provider_name: Service Control Manager
event_id: 7045
event_data.ServiceName: ExampleSvc
event_data.ImagePath: "C:\Program Files\Example\svc.exe"
event_data.ServiceType: user mode service
event_data.StartType: auto start
event_data.AccountName: LocalSystem
SparkLogs: service_installed, Notice, service_installed: NOTABLE: A service was installed in the system.
Where to look next:
- Review ServiceName, ImagePath, StartType, ServiceType, and AccountName.
- Compare with approved software install windows.
Fields it can set: command_line, win.eventlog.system.account_name, win.eventlog.system.image_path, win.eventlog.system.service_name, win.eventlog.system.service_type, win.eventlog.system.start_type
service_start_failed
A Windows service failed to start.
Severity: Error
Impact: The service is unavailable until startup succeeds or its dependency error is fixed.
Channel: System
Provider: Service Control Manager
Event ids: 7000
Where to look next:
- Review the service error and dependencies.
- Check for paired timeout or account logon failures.
Fields it can set: win.eventlog.system.service_error, win.eventlog.system.service_name
service_start_timeout
A Windows service did not connect before the startup timeout.
Severity: Error
Impact: The service may be unavailable or too slow to initialize under current load or dependency state.
Channel: System
Provider: Service Control Manager
Event ids: 7009
Where to look next:
- Pair with SCM 7000 or 7011 for the same service.
- Check whether timeout policy, dependencies, or service account issues changed.
Fields it can set: win.eventlog.system.service_name
smb_delayed_write_lost
Windows could not save cached file data to a network share and the data was lost.
Severity: Error
Impact: Data an application believed it had written to a share was discarded. The application is not told. Repeated occurrences point at the link to the file server.
Channel: System
Provider: mrxsmb, Mup, mrxsmb10, mrxsmb20
Event ids: 50, 139
Where to look next:
- Check the link to the file server, and whether the server restarted under open handles.
- Read the rate rather than one instance: a steady stream means the session keeps dropping.
Related reasons:
ntfs_delayed_write_lost: the same loss for a file on a local volume
smb_server_transport_bind_failed
The Windows file-sharing service could not bind to a network transport.
Severity: Warning (server) / Info (workstation)
Impact: On a file server, clients may not reach shares over the affected transport. On a workstation this normally accompanies a network adapter appearing or disappearing.
Channel: System
Provider: Server
Event ids: 2504
Where to look next:
- Identify the transport device from the message; NetBT paths name the adapter GUID.
- On a server, confirm shares are reachable on every address clients use.
smb_share_recreate_failed
A file share could not be recreated because the folder it points at no longer exists.
Severity: Warning
Impact: Clients and scripts using that share name fail to connect until the folder is restored or the share definition is removed.
Channel: System
Provider: Server
Event ids: 2511
Where to look next:
- Read the share name and path from the message; the event names both remedies.
- Check whether the folder was moved rather than deleted before removing the share.
storage_controller_reset
The AHCI storage controller reported a reset or timeout condition.
Severity: Error
Impact: A controller reset can stall storage IO and may indicate a failing device, cable, controller, or driver path.
Channel: System
Provider: storahci
Where to look next:
- Confirm the exact storahci event id and message on the affected host.
- Correlate with disk retry and paging errors.
time_sync_failed
Windows Time could not reach or resolve its time source.
Severity: Warning
Impact: Clock skew can break Kerberos, TLS validation, scheduled jobs, and timeline analysis.
Channel: System
Provider: Microsoft-Windows-Time-Service
Event ids: 134
Where to look next:
- Check the configured peer and DNS result.
- Correlate with authentication or certificate errors.
Fields it can set: win.eventlog.system.time_peer
tls_cert_expired
A remote server presented a certificate that has expired or is not yet valid, and the TLS connection failed.
Severity: Error
Impact: The connection to that endpoint does not complete, and retrying does not help until the certificate is renewed or the local clock is corrected.
Channel: System
Provider: Schannel
Event ids: 36881
Where to look next:
- Identify the endpoint from the calling process and confirm its certificate validity dates.
- Check the local clock: a host with a wrong date rejects valid certificates this way.
Related reasons:
tls_cert_name_mismatch: the same rejection for a name that does not matchtls_cert_untrusted_ca: the same rejection for an issuer the host does not trust
tls_cert_name_mismatch
A TLS certificate name did not match the expected server name.
Severity: Error
Impact: TLS connections may fail or users may be exposed to misconfiguration or impersonation risk.
Channel: System
Provider: Schannel
Event ids: 36884
Where to look next:
- Verify the requested hostname and certificate subject/SAN.
- Check whether the peer is expected for the application.
tls_cert_untrusted_ca
A remote server presented a certificate issued by an authority this host does not trust, and the TLS connection failed.
Severity: Error
Impact: The connection to that endpoint does not complete. Nothing in the presented certificate can be relied on, so the identity of the peer is unestablished.
Channel: System
Provider: Schannel
Event ids: 36882
Where to look next:
- Check whether a TLS-inspecting appliance or proxy is in the path and whether its authority is deployed to this host.
- Confirm the endpoint is one this host is meant to reach.
Related reasons:
tls_cert_expired: the same rejection for a certificate outside its validity windowtls_cert_name_mismatch: the same rejection for a name that does not match
tls_cipher_mismatch
A remote client offered no cipher suite this host accepts, and the TLS handshake failed.
Severity: Warning
Impact: The client cannot connect to this host over TLS. The host itself is unaffected and continues serving clients that offer a supported suite.
Channel: System
Provider: Schannel
Event ids: 36874
Where to look next:
- Identify the clients still offering obsolete suites before the remaining legacy suites are withdrawn.
- Steady low-rate volume from unknown sources is usually scanning rather than a real client.
Related reasons:
kerberos_etype_unsupported: the same legacy-cryptography problem inside Kerberos
tls_client_credential_failed
The host could not create a TLS client credential, so a connection that needed to present a client certificate could not build one.
Severity: Error (server) / Warning (workstation)
Impact: The application that asked for the credential cannot complete authenticated TLS connections that require one. Connections that present no client certificate are unaffected.
Channel: System
Provider: Schannel
Event ids: 36871
Where to look next:
- Read the requesting process from the message and identify which integration needs a client certificate.
- Check that the certificate exists in the expected store and that its private key is readable by the calling account.
Related reasons:
cert_enroll_failed: a certificate that never arrived, as opposed to one that cannot be usedtls_server_credential_failed: the same class of failure on the credential this host serves with
tls_server_credential_failed
The private key behind this host's TLS server certificate could not be accessed.
Severity: Error
Impact: Clients cannot negotiate TLS with the endpoint that uses that certificate until the key or its permissions are repaired.
Channel: System
Provider: Schannel
Event ids: 36870
Where to look next:
- Check the private key permissions for the certificate the affected service is bound to.
- Confirm the key container survived the last certificate renewal or import.
Related reasons:
tls_client_credential_failed: the same class of failure on an outbound client credential
tpm_attestation_failed
TPM attestation failed for a critical component.
Severity: Error
Impact: Device trust or security posture checks may fail until TPM or firmware state is corrected.
Channel: System
Provider: Microsoft-Windows-TPM-WMI
Event ids: 1040
Where to look next:
- Check TPM health and Secure Boot posture.
- Correlate with firmware or dbx update events.
unexpected_shutdown
The previous shutdown was not clean: the host stopped without shutting down and came back on the next start.
Severity: Serious or Error on a server or an unknown host class, depending on which record reports it and what level that record carried; Warning on a workstation.
Impact: Unclean shutdown can interrupt workloads, lose in-memory state, and leave storage or applications needing recovery. It also complicates incident timelines.
Channel: System
Provider: EventLog, Microsoft-Windows-Kernel-Power
Event ids: 41, 6008
| Case | Severity | Ticket class | Event ids |
|---|---|---|---|
event_log | Warning to Serious | os_stability | |
kernel_power | Warning to Error | os_stability | 41 |
Where to look next:
- Use with bugcheck as the crash triangle around one boot gap.
- Inspect bugcheck_code when present: a nonzero value separates a crash from a power loss.
- Check the nearest clean shutdown and boot markers.
Related reasons:
bugcheck: the crash that caused some of these, which is a different fact
Fields it can set: win.eventlog.system.bugcheck_code
vpn_connected
A remote-access connection was established.
Severity: Notice
Channel: System
Provider: RasMan
Event ids: 20267
Where to look next:
- Read the profile name and the user from the message.
- Read it beside the failures on the same host to tell a retry from a broken tunnel.
Related reasons:
vpn_dial_failed: a dial attempt that did not connect, which this is the counterpart to
vss_shadow_aborted
A volume shadow-copy operation was aborted by shadow storage limits.
Severity: Error or Warning
Impact: A backup or restore-point operation may have lost its usable snapshot.
Channel: System
Provider: Volsnap
Event ids: 13, 14, 15, 16, 20, 23, 24, 27, 28, 29, 32, 35, 36
What you see: A Volsnap event in the System log saying the shadow copies of a volume were aborted, or that a new one was not created, with the cause in the same sentence: a configured storage limit, an IO failure, a storage volume that is not present, paged heap exhausted, or the shadow copy storage failing to grow.
What it means: The snapshot in flight is gone; the restore point that depended on it does not exist. The two storage-growth events are the exception: they forecast risk to existing copies, not a loss yet. A configured ceiling, not a fault, leaves the same missing restore point and recurs every cycle until the limit changes.
What to do: Confirm from the backup product whether the job retried or fell back, then review the shadow storage size against how much the volume changes between snapshots.
When to ignore it: One aborted snapshot alone is not evidence of lost recovery points; that condition is a run of these over days, not a single event.
References:
- Microsoft Learn - vssadmin resize shadowstorage: The shadow storage size and per-volume limit the storage causes here run into.
Example
The shadow copies of volume G: were aborted because of an IO failure on volume G:.
channel: System
provider_name: Volsnap
event_id: 14
event_data.VolumeName: G:
SparkLogs: vss_shadow_aborted, Error, vss_shadow_aborted: NOTABLE: The shadow copies of volume G: were aborted because of an IO failure on volume G:.
| Case | Severity | Ticket class |
|---|---|---|
storage_limit_reached | Error | backup |
abort_on_failure | Error | backup |
storage_growth_failed | Warning | backup |
Where to look next:
- Confirm whether the backup job retried or fell back successfully.
- Review shadow storage sizing and churn.
Related reasons:
vss_shadow_lostvss_snapshots_failing_for_spacevss_data_integrity_writer_failed
Fields it can set: win.eventlog.system.volume
vss_shadow_lost
Volume shadow copies were deleted because shadow storage could not grow.
Severity: Error
Impact: Restore points or backup recovery sources may be missing for the affected volume.
Channel: System
Provider: Volsnap
Event ids: 25
What you see: A Volsnap event in the System log saying the shadow copies of a volume were deleted because the shadow copy storage could not grow in time.
What it means: Copies that existed are gone: the restore points a customer believed they had are the ones deleted. This is the one Volsnap event that states a completed loss, not a risk of one, and the shortfall shows up at restore time. A host that logs it has a real shadow storage sizing or IO problem, not routine housekeeping.
What to do: Check the backup job outcomes around the event time, then raise the shadow storage limit for the volume or reduce what it has to hold.
When to ignore it: Routine reclamation of the oldest copy to stay under a count limit is a different Volsnap event.
References:
- Microsoft Learn - vssadmin resize shadowstorage: The per-volume shadow storage allocation that could not grow.
Example
The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.
channel: System
provider_name: Volsnap
event_id: 25
event_data.VolumeName: C:
SparkLogs: vss_shadow_lost, Error, vss_shadow_lost: NOTABLE: The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.
Where to look next:
- Check backup job outcomes near the event time.
- Review shadow storage limits for the affected volume.
Related reasons:
vss_shadow_abortedvss_snapshots_failing_for_space
Fields it can set: win.eventlog.system.volume
vswitch_config_restore_failed
Hyper-V virtual switch failed to restore port configuration.
Severity: Error or Warning (server or unknown) / Info (workstation)
Impact: Virtual networking may not restore correctly for a VM, vNIC, WSL switch, or host virtual adapter.
Channel: System
Provider: Microsoft-Windows-Hyper-V-VmSwitch
Event ids: 15
Where to look next:
- Check the virtual switch or port name in the raw event.
- On servers, correlate with VM connectivity complaints.
Fields it can set: win.eventlog.system.ntstatus
win_app_error_dialog_shown
An application error popup was recorded.
Severity: Minor
Impact: A foreground or service application may have failed and required user or operator attention.
Channel: System
Provider: Application Popup
Event ids: 26
Where to look next:
- Read the popup text in the raw message.
- Look for nearby application crash records.
winre_servicing_failed
Servicing of the Windows recovery environment failed on this device.
Severity: Error
Impact: The recovery environment stays at its previous state, and updates that depend on servicing it can keep failing; the most common cause is a recovery partition with too little free space.
Channel: System
Provider: Microsoft-Windows-WinREAgent
Event ids: 4502
Where to look next:
- Check free space on the recovery partition.
- Check whether later update attempts on this device fail the same way.
Related reasons:
patch_install_failed: Update installs can keep failing while recovery servicing is broken
wlan_limited_connectivity
Wireless networking entered limited connectivity.
Severity: Warning
Impact: The host may lose network reachability or degrade user sessions until wireless connectivity recovers.
Channel: System
Provider: Microsoft-Windows-WLAN-AutoConfig
Event ids: 4003
Where to look next:
- Look for recurrence on the same adapter or SSID.
- Correlate with DNS timeouts and DHCP renewal failures.
Vocabularies
These token sets are closed: a value outside the set leaves its field unset instead of invented.
reclaim_cause
Which ceiling the volume snapshot driver was holding to when it reclaimed the oldest shadow copy: the disk space shadow copies may occupy on the volume, the number of shadow copies that may exist for it, or copies already marked for deletion being cleared so that newer ones can be kept. The three are the axes to compare when a restore point a customer expected is missing.
space_limitcount_limitdelete_pending
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.