Windows System event log

1channels

75curated reasons

8themes fed

Livestatus

Classic Windows Event Log System channel, the OS core. Covers storage corruption and disk errors, the crash and reboot trail (Kernel-Power 41, bugcheck 1001, EventLog 6008), Service Control Manager install and crash events, WHEA hardware errors, DCOM failures, Hyper-V vSwitch changes, and IIS/WAS plus Failover Clustering spillover. Nothing is deleted: high-volume chatter is retained at the Debug severity tier. Some events state a severity that does not match their real impact; the stored severity is authoritative, and severity_original keeps the event's own value when the two differ.

Feed id: win.eventlog.system.

Channels

This feed reads one Windows Event Log channel, System.

Fields

Field	Type	Unit	Meaning
win.eventlog.system.service_name	string		Windows service (or driver service) the event is about: SCM 7000/7009/7011/7023/7024/7031/7034/7045, UserPnp 20003. The recurrence + vendor-recognition join key (vendor service crashes arrive as SCM events keyed on this name).
win.eventlog.system.image_path	string		Installed service IMAGE path from SCM 7045, with the arguments of the ImagePath command line removed. Unset where the image cannot be split off unambiguously (an unterminated quote, or an unquoted path containing spaces), so the value is always a path and never a command line. The full ImagePath text is root command_line.
win.eventlog.system.service_type	string		Service type text from SCM 7045 (kernel mode driver | user mode service | ...).
win.eventlog.system.start_type	string		Service start type text from SCM 7045 (auto start | demand start | ...).
win.eventlog.system.account_name	string		Account the installed service runs as, from SCM 7045 (LocalSystem etc.).
win.eventlog.system.crash_count	int		How many times the service has terminated unexpectedly, from SCM 7031/7034. The flapping-service recurrence datum.
win.eventlog.system.service_error	string		Error the service exited/failed with, from SCM 7000/7023/7024. Stored as logged; may be a %%nnnn message-catalog reference.
win.eventlog.system.bugcheck_code	string		BugcheckCode from Kernel-Power 41 (decimal, as logged). Nonzero: a bug check ended the previous session. 0: no bug check was recorded, and the cause (power loss, a hang, a held power button) is undetermined.
win.eventlog.system.bugcheck_name	string		Bug check constant name for the stop code (DRIVER_IRQL_NOT_LESS_OR_EQUAL), from Kernel-Power 41 and WER-SystemErrorReporting 1001. Absent when the code is 0 or not a documented bug check.
win.eventlog.system.sleep_in_progress	string		SleepInProgress from Kernel-Power 41, as logged: the sleep state the system was in when the session ended. A number, not a flag; values other than 0 and 1 occur.
win.eventlog.system.connected_standby_in_progress	string		ConnectedStandbyInProgress from Kernel-Power 41, as logged (true or false): whether Modern Standby was active when the session ended.
win.eventlog.system.bugcheck_text	string		Full bugcheck string from WER-SystemErrorReporting 1001, e.g. "0x0000001e (0x..., ...)". Kept verbatim: the code plus its four parameters are the crash identity.
win.eventlog.system.dump_file	string		Memory-dump path from WER-SystemErrorReporting 1001.
win.eventlog.system.report_id	string		WER report id from WER-SystemErrorReporting 1001; joins to the WER report store. A GUID on current builds; the minidump base name on Windows Server 2012 R2 (build 9600).
win.eventlog.system.driver_name	string		Driver that failed to load, from Kernel-PnP 219 (FailureName, e.g. \Driver\WUDFRd).
win.eventlog.system.device_instance	string		Device instance path the event is about: Kernel-PnP 219, WHEA-Logger 17-20 (PrimaryDeviceName), UserPnp 20003, DriverFrameworks-UserMode driver installs.
win.eventlog.system.error_source	string		WHEA error source enum from WHEA-Logger 17-20 (ErrorSource; numeric string, locale-stable).
win.eventlog.system.cper_decode	string		How much of the WHEA-Logger 1 hardware error record decoded: complete, partial (the record carries fewer bytes than it declares, or more sections than are read), or invalid (a signature, the revision, a length, a section range or the timestamp failed validation; no other cper field is set).
win.eventlog.system.cper_error_ts	string		Time of the error as the WHEA-Logger 1 record states it (RFC 3339, UTC), as firmware or Windows recorded it and subject to the platform clock. Present only when the record marks its timestamp valid and precise and the timestamp reads as one date.
win.eventlog.system.cper_revision	string		Record format revision from the WHEA-Logger 1 error record header, major.minor (2.10).
win.eventlog.system.cper_severity	string		Severity the WHEA-Logger 1 error record header states: recoverable (uncorrected but not fatal), fatal, corrected or informational.
win.eventlog.system.cper_notification	string		How the WHEA-Logger 1 error was reported (boot, mce, cmc, pcie, nmi, and the other notification types the UEFI error record format defines), or the raw type GUID when it is not a published one. boot means the record was found when Windows started.
win.eventlog.system.cper_flags	string		Header flags of the WHEA-Logger 1 error record, comma-separated: previous_error (the error happened in an earlier session), recovered, simulated (deliberately injected); none when no flag is set.
win.eventlog.system.cper_flags_raw	string		Header flags of the WHEA-Logger 1 error record as a hex word, including any reserved bits.
win.eventlog.system.cper_creator	string		Software that wrote the WHEA-Logger 1 error record: windows, device_driver, or the raw creator GUID.
win.eventlog.system.cper_section_count	int		Number of sections the WHEA-Logger 1 error record declares.
win.eventlog.system.cper_section_types	string		Type of each section in the WHEA-Logger 1 error record, in record order, comma-separated: firmware_error_record_reference, processor_generic, ia32_x64_mca, platform_memory, pcie, generic, or the raw type GUID. At most the first 16.
win.eventlog.system.cper_section_severities	string		Severity of each section in the WHEA-Logger 1 error record, in the same order as cper_section_types.
win.eventlog.system.cper_firmware_record_types	string		For each firmware error record reference section of the WHEA-Logger 1 record, the kind of firmware record it points to: ipf_sal, soc_type1, soc_type2, or the raw number. The referenced record itself is held by firmware and is not in the event.
win.eventlog.system.framework_version	string		UMDF framework version from DriverFrameworks-UserMode install narration.
win.eventlog.system.volume	string		Volume the storage event is about: Ntfs 55/130 (DriveName/VolumeName), Volsnap 25/36 (VolumeName).
win.eventlog.system.filesystem	string		Filesystem type the filesystem_* reasons name (ntfs, refs, fat32), read from the provider that raised the event. A constant per provider, not a decoded field: this fleet has never carried a non-NTFS provider for these reasons.
win.eventlog.system.clsid	string		COM server CLSID from DistributedCOM 10010.
win.eventlog.system.time_peer	string		Configured NTP peer from Time-Service 134 (DomainPeer).
win.eventlog.system.update_title	string		Update the WindowsUpdateClient 20 install outcome is about (updateTitle). The fleet pivot for separating a bad update from a bad device.

Curated reasons

Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.

Reason	Ticket class	Severity
av_unsigned_code_blocked	endpoint_protection	Serious
dcom_activation_timeout	app_stability	Minor
dcom_register_timeout	app_stability	Minor
dcom_start_failed	app_stability	Minor
disk_bad_block	storage	Serious
disk_controller_error	storage	Error
disk_io_retried	storage	Warning
disk_paging_error	storage	Warning
disk_surprise_removal	storage	Warning
driver_load_failed	hardware	Warning
ephemeral_port_alloc_failed	networking	Notice
failover_cluster_csv_unavailable	clustering	Severe
failover_cluster_node_removed	clustering	Serious
failover_cluster_quorum_loss	clustering	Severe
failover_cluster_resource_failed	clustering	Serious
failover_cluster_resource_hang	clustering	Serious
failover_cluster_resource_host_crash	clustering	Serious
failover_cluster_service_down	clustering	Severe
filesystem_corruption	storage	Critical (corrupted MFT record, MFT torn write, volume cannot be corrected, disk-provider corruption marker) / Serious (corruption in a directory index or another structure) / Error (torn write on a data file) / Warning (repair completed, repair posting throttled)
filesystem_delayed_write_lost	storage	Serious (path on the system volume) / Error (path anywhere else)
filesystem_transaction_log_operation_failed	storage	Warning (flush failed on a live volume, recovery error, metadata reset) / Notice (flush failed on a volume that no longer exists) / Error (resource manager could not start)
gpu_driver_reset	hardware	Notice
hardware_error_corrected	hardware	Notice
hardware_error_uncorrected	hardware	Error or Minor
http_ssl_binding_created	certificates	Notice
http_ssl_binding_deleted	certificates	Notice
http_ssl_config_failed	certificates	Error
hyperv_vswitch_config_restore_failed	virtualization	Error or Warning (server or unknown) / Info (workstation)
iis_apppool_disabled	web	Serious (server or unknown) / Warning (workstation)
iis_apppool_identity_invalid	web	Error or Warning
iis_apppool_worker_start_failed	web	Error or Warning
iis_worker_crash	web	Warning
kerberos_cert_domain_unresolved	auth	Info (capped)
kerberos_etype_unsupported	auth	Warning
kerberos_pac_verify_failed	auth	Warning
kerberos_smartcard_cert_missing	auth	Warning
kerberos_weak_krbtgt_key	auth	Warning
nic_driver_fault_reported	networking	Warning
nic_driver_load_failed	networking	Error
nic_link_down	networking	Warning or Info
os_bsod	os_stability	Serious (server or unknown) / Error (workstation)
patch_install_deferred	patching	Info or Verbose
patch_install_failed	patching	Minor or Info
platform_tamper_indicator_reported	endpoint_protection	Error or Warning
rds_license_server_unactivated	licensing	Warning
rds_license_tracking_failed	licensing	Warning
rds_licensing_service_failed	licensing	Error
secure_boot_cert_update_pending	hardware	Warning
security_agent_service_start_failed	endpoint_protection	Warning
security_agent_service_terminated	endpoint_protection	Minor
service_crashed	app_stability	Error
service_exited_with_error	app_stability	Error
service_hang	app_stability	Error
service_installed	security_audit	Notice
service_start_failed	app_stability	Error
service_start_timeout	app_stability	Error
smb_delayed_write_lost	storage	Error
smb_server_transport_bind_failed	networking	Warning (server) / Info (workstation)
smb_share_recreate_failed	storage	Warning
storage_controller_reset	storage	Warning
time_sync_failed	time_sync	Warning
tls_cert_expired	certificates	Error
tls_cert_name_mismatch	certificates	Error
tls_cert_untrusted_ca	certificates	Error
tls_cipher_mismatch	certificates	Warning
tls_client_credential_failed	certificates	Error (server) / Warning (workstation)
tls_server_credential_failed	certificates	Error
tpm_attestation_failed	hardware	Error
unexpected_shutdown	os_stability	Serious or Error on a server or an unknown host class, depending on which record reports it and what level that record carried; Warning on a workstation.
vpn_connected	vpn	Notice
vss_shadow_aborted	backup	Error or Warning
vss_snapshots_failing_for_space	backup	Error
win_app_error_dialog_shown	app_stability	Minor
winre_servicing_failed	patching	Error
wlan_limited_connectivity	networking	Warning

av_unsigned_code_blocked

A security agent blocked a process whose image contained unsigned or corrupted code from performing a privileged operation.

Severity: Serious

Impact: The privileged operation did not happen, so nothing on the host changed. What the event establishes is that a binary running on this machine fails a code-integrity check.

Channel: System

Provider: mfehidk

Event ids: 514

Where to look next:

• Identify the named executable and confirm whether it is expected on this host.
• Check whether the same executable appears on other hosts in the fleet.
• A legitimate application with a stripped or broken signature produces this line too.

Related reasons:

• av_threat_detected: a named threat rather than a code-integrity failure

dcom_activation_timeout

DCOM activation timed out.

Severity: Minor

Impact: The requested COM application may be unavailable or stuck during activation.

Channel: System

Provider: Microsoft-Windows-DistributedCOM

Event ids: 10029

Where to look next:

• Resolve the CLSID/AppID where present.
• Correlate with service control and application errors.

dcom_register_timeout

A DCOM server did not register in time.

Severity: Minor

Impact: The COM server or application may be hung, unavailable, or too slow to start.

Channel: System

Provider: Microsoft-Windows-DistributedCOM

Event ids: 10010

Where to look next:

• Use the CLSID to identify the application.
• Check adjacent service start or application error events.

Fields it can set: win.eventlog.system.clsid

dcom_start_failed

DCOM failed while starting an application or service.

Severity: Minor

Impact: The COM-backed application may fail to launch or serve dependent callers.

Channel: System

Provider: Microsoft-Windows-DistributedCOM

Event ids: 10005

Where to look next:

• Identify the named service or server from the event body.
• Check SCM errors for the same service.

disk_bad_block

A disk reported a bad block.

Also reported by: Windows storage event channels

Severity: Serious

Impact: Data in the affected block may be unreadable, and the drive is consuming its spare-block reserve.

Channel: System

Provider: disk

Event ids: 7

Where to look next:

• Read the device path from the message and check the drive's health counters.
• Plan replacement rather than repair: bad blocks do not heal.

Related reasons:

• disk_io_retried: an IO that recovered after a retry
• filesystem_corruption: damage found in the file system on the volume, a different layer and a different fix

disk_controller_error

A disk controller error was reported for a storage device.

Severity: Error

Impact: Repeated controller errors can precede disk, cabling, controller, or removable-media failure.

Channel: System

Provider: disk

Event ids: 11

Where to look next:

• Check whether the device path maps to a fixed disk or removable media.
• Correlate with disk_io_retried, disk_paging_error, and NTFS corruption on the same device.

disk_io_retried

A disk IO operation had to be retried.

Severity: Warning

Impact: Retries can add latency and may indicate a degrading disk, cable, controller, or transient removable-device issue.

Channel: System

Provider: disk

Event ids: 153

Where to look next:

• Check recurrence per device.
• Correlate with paging errors or controller resets.

disk_paging_error

Windows reported a disk error during a paging operation.

Also reported by: Windows storage event channels

Severity: Warning

Impact: The affected device may be slow, unstable, or disconnecting under IO pressure.

Channel: System

Provider: disk

Event ids: 51

Where to look next:

• Pivot on the device path in the raw event message.
• Look for adjacent controller reset or retry events.

disk_surprise_removal

A disk disappeared without an orderly removal path.

Also reported by: Windows storage event channels

Severity: Warning

Impact: Unexpected removal can interrupt IO and may corrupt open files or workloads using the device.

Channel: System

Provider: disk

Event ids: 157

Where to look next:

• Identify whether the device is USB, virtual, or fixed storage.
• Check adjacent service or backup failures that used the disk.

driver_load_failed

A device driver failed to load.

Severity: Warning

Impact: The device may be unavailable, degraded, or missing expected driver functionality.

Channel: System

Provider: Microsoft-Windows-Kernel-PnP

Event ids: 219

Where to look next:

• Review driver_name, device_instance, and the result code.
• Check Device Manager or driver updates for the same device instance.

Fields it can set: win.eventlog.system.device_instance, win.eventlog.system.driver_name

ephemeral_port_alloc_failed

A local port could not be allocated from the ephemeral port range.

Severity: Notice

Impact: One outbound connection attempt failed at that moment. A sustained rate means the device runs out of local ports, which breaks new connections across every application on the host.

Channel: System

Provider: Tcpip

Event ids: 4231, 4266

Where to look next:

• Check the rate over time rather than the single event.
• Look for an application leaking sockets, or a port range narrowed by configuration.

A single occurrence is common and self-correcting. The actionable form is a sustained rate on one device.

failover_cluster_csv_unavailable

A Cluster Shared Volume became unavailable or paused.

Severity: Severe

Impact: Clustered workloads using the CSV may lose storage access or degrade until the volume recovers.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 5120, 5142

Where to look next:

• Identify the CSV and owning node.
• Check storage, network, and redirected-access state.

failover_cluster_node_removed

A failover cluster node was removed from active membership.

Severity: Serious

Impact: Cluster capacity or availability may be reduced, and workloads may fail over or become degraded.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1135

Where to look next:

• Identify the node and reason in the event body.
• Check network, heartbeat, and quorum events around the removal.

failover_cluster_quorum_loss

The failover cluster lost quorum or its quorum resource.

Severity: Severe

Impact: The cluster may stop services or be unable to make safe failover decisions.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1561

Where to look next:

• Review quorum configuration, including the quorum resource.
• Check node and network reachability.

failover_cluster_resource_failed

A failover cluster resource failed.

Severity: Serious

Impact: A clustered workload or dependency may be offline, failed over, or degraded.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1069

Where to look next:

• Identify the resource and group.
• Check whether the resource recovered or failed over.

failover_cluster_resource_hang

A clustered resource became unresponsive and was terminated.

Severity: Serious

Impact: The workload can become unavailable or fail over while the cluster recovers the resource.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1230

Where to look next:

• Identify the resource and owning node.
• Check whether termination was followed by successful restart or failover.

failover_cluster_resource_host_crash

The cluster Resource Hosting Subsystem crashed.

Severity: Serious

Impact: Cluster resource monitoring or hosting may be disrupted, causing dependent resources to fail or restart.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1146

Where to look next:

• Check resource DLLs and the resource hosted by RHS.
• Look for paired resource failure events.

failover_cluster_service_down

The cluster service stopped or was forced down.

Severity: Severe

Impact: Cluster coordination may be unavailable, risking workload outage or preventing failover.

Channel: System

Provider: Microsoft-Windows-FailoverClustering

Event ids: 1006, 1073, 1177

Where to look next:

• Check quorum state and node membership.
• Correlate with node removal and quorum-loss events.

filesystem_corruption

The filesystem found damage in the structures on a volume, or the disk layer confirmed corruption directly, or NTFS reported repairing it.

Also reported by: Windows storage event channels

Severity: Critical (corrupted MFT record, MFT torn write, volume cannot be corrected, disk-provider corruption marker) / Serious (corruption in a directory index or another structure) / Error (torn write on a data file) / Warning (repair completed, repair posting throttled)

Impact: Volume integrity is at risk; applications and files on that volume may be affected until repair is complete. Damage to the Master File Table reaches every file on the volume, because it holds the record of where each of them lives.

Channel: System

Provider: Ntfs, Microsoft-Windows-Ntfs, disk

Event ids: 7, 55, 130, 131, 132, 133

Case	Severity	Ticket class
corruption_discovered	Serious to Critical	storage
correction_required	Critical	storage
torn_write_detected	Error to Critical	storage
repair_activity	Warning	storage
repair_posting_throttled	Warning	storage
disk	Critical	storage

Where to look next:

• Identify the volume from structured fields or message text, and read which structure the message names.
• For Master File Table damage or a volume that cannot be corrected, plan an offline chkdsk and check backup state first.
• Check whether chkdsk or storage diagnostics completed after the event.
• Read the rate as well as the instance: repeated repairs on one volume point at the device.

Related reasons:

• filesystem_transaction_log_operation_failed: the NTFS transaction log failing, a different fact with a different fix

Fields it can set: win.eventlog.system.filesystem, win.eventlog.system.volume

filesystem_delayed_write_lost

Windows could not save cached file data to the volume and the data was lost.

Severity: Serious (path on the system volume) / Error (path anywhere else)

Impact: Data an application believed it had written was discarded. The application is not told. Repeated occurrences point at the connection to the storage device rather than at the file system.

Channel: System

Provider: Ntfs

Event ids: 50

Where to look next:

• Check the path to the device: cabling, controller, and for network or removable volumes the link.
• Read the rate rather than one instance: a steady stream means the storage path is still failing.

Related reasons:

• filesystem_corruption: damage found in on-disk structures, a different fact with a different fix
• smb_delayed_write_lost: the same loss reported by the SMB client for a file on a network share

Fields it can set: win.eventlog.system.filesystem, win.eventlog.system.volume

filesystem_transaction_log_operation_failed

The NTFS transaction log on a volume could not be written, replayed, or brought up.

Severity: Warning (flush failed on a live volume, recovery error, metadata reset) / Notice (flush failed on a volume that no longer exists) / Error (resource manager could not start)

Impact: NTFS uses the transaction log to undo changes that did not finish. While it is unavailable, a change interrupted on that volume may be left half applied.

Channel: System

Provider: Ntfs, Microsoft-Windows-Ntfs, NTFS

Event ids: 134, 136, 137, 140

Case	Severity	Ticket class
flush_failed	Notice to Warning	storage
recovery_error	Warning	storage
metadata_reset	Warning	storage
start_failed	Error	storage

Where to look next:

• Identify the volume, and check whether it is still present on the host.
• For a live volume, check the path to the device and whether the host was under memory pressure.

Related reasons:

• filesystem_corruption: damage found in on-disk structures, answered with a volume repair
• filesystem_delayed_write_lost: cached file data discarded before it reached the volume

Fields it can set: win.eventlog.system.filesystem, win.eventlog.system.volume

gpu_driver_reset

The NVIDIA display driver reset.

Severity: Notice

Impact: GPU resets can interrupt interactive sessions, remote desktop, rendering, or GPU-backed workloads.

Channel: System

Provider: nvlddmkm

Event ids: 153

Where to look next:

• Check display driver version and recent GPU load.
• Correlate with application hangs or desktop session resets.
• Check for an adjacent driver install: an upgrade resets the display stack and is expected.
• Repetition WITHOUT a driver install is the real signal; a single reset usually is not.

hardware_error_corrected

Windows Hardware Error Architecture reported a CORRECTED hardware error.

Severity: Notice

Impact: No consequence yet: the hardware caught the fault. Recurrence is early warning for marginal hardware (memory, PCIe links).

Channel: System

Provider: Microsoft-Windows-WHEA-Logger

Event ids: 1, 17, 19

Case	Severity	Ticket class	Event ids
error_source_record	Notice	hardware	17, 19
boot_corrected	Notice	hardware	1

Where to look next:

• Track recurrence by error_source and device_instance.
• A burst after a driver or firmware change points at the change, not the silicon.

Related reasons:

• hardware_error_uncorrected: the same error sources when correction fails

Fields it can set: win.eventlog.system.cper_creator, win.eventlog.system.cper_decode, win.eventlog.system.cper_error_ts, win.eventlog.system.cper_firmware_record_types, win.eventlog.system.cper_flags, win.eventlog.system.cper_flags_raw, win.eventlog.system.cper_notification, win.eventlog.system.cper_revision, win.eventlog.system.cper_section_count, win.eventlog.system.cper_section_severities, win.eventlog.system.cper_section_types, win.eventlog.system.cper_severity, win.eventlog.system.device_instance, win.eventlog.system.error_source

hardware_error_uncorrected

Windows Hardware Error Architecture reported an UNCORRECTED hardware error.

Severity: Error or Minor

Impact: The fault was not contained: data loss, corruption, or a crash may follow. Treat as a hardware incident, not a log curiosity.

Channel: System

Provider: Microsoft-Windows-WHEA-Logger

Event ids: 1, 18, 20

Case	Severity	Ticket class	Event ids
error_source_record	Error	hardware	18, 20
boot_unrecoverable	Error	hardware	1
boot_recoverable	Minor	hardware	1

Where to look next:

• Track recurrence by error_source and device_instance.
• Correlate with subsequent bugchecks or disk errors on the same host.
• A record reported at boot happened in the previous session. When the line says details_in_firmware, the details are in the platform firmware and the vendor's hardware diagnostics read them.

Related reasons:

• hardware_error_corrected: the same error sources when the hardware catches the fault
• kernel_crash: a kernel crash near the boot this record was reported in

Fields it can set: win.eventlog.system.cper_creator, win.eventlog.system.cper_decode, win.eventlog.system.cper_error_ts, win.eventlog.system.cper_firmware_record_types, win.eventlog.system.cper_flags, win.eventlog.system.cper_flags_raw, win.eventlog.system.cper_notification, win.eventlog.system.cper_revision, win.eventlog.system.cper_section_count, win.eventlog.system.cper_section_severities, win.eventlog.system.cper_section_types, win.eventlog.system.cper_severity, win.eventlog.system.device_instance, win.eventlog.system.error_source

http_ssl_binding_created

An HTTPS certificate binding was created for a listener endpoint on this host.

Severity: Notice

Impact: The endpoint can serve HTTPS with the bound certificate. Routine after an installation or a certificate replacement.

Channel: System

Provider: Microsoft-Windows-HttpService, Microsoft-Windows-HttpEvent

Event ids: 120, 15301

Where to look next:

• Read the endpoint from the message: an address and port, or a host name and port.
• A creation shortly after a deletion for the same endpoint is a certificate replacement.
• The modern record also names the process and the account that made the change.

Related reasons:

• http_ssl_binding_deleted: the same binding table losing an endpoint
• http_ssl_config_failed: a binding that exists but cannot be used

http_ssl_binding_deleted

The HTTPS certificate binding for a listener endpoint was removed on this host.

Severity: Notice

Impact: Clients reaching that endpoint over HTTPS get no certificate until a binding is put back. This is routine during an uninstall or the first half of a certificate replacement.

Channel: System

Provider: Microsoft-Windows-HttpService, Microsoft-Windows-HttpEvent

Event ids: 119, 15300

Where to look next:

• Read the endpoint from the message: an address and port, or a host name and port.
• Check whether a creation record for the same endpoint follows, which is what a certificate replacement looks like.
• The modern record also names the process and the account that made the change.

Related reasons:

• http_ssl_binding_created: the same binding table gaining an endpoint
• http_ssl_config_failed: a binding that exists but cannot be used

http_ssl_config_failed

An HTTPS listener endpoint on this host could not use its SSL configuration.

Severity: Error

Impact: Clients connecting to that endpoint over HTTPS fail the TLS handshake until the binding or the certificate behind it is fixed.

Channel: System

Provider: Microsoft-Windows-HttpEvent

Event ids: 15021

Where to look next:

• Read the endpoint from the message, then list the certificate bindings for it.
• Check whether the bound certificate is still in the store and still valid.
• Check that the service account can read the private key of the bound certificate.

Related reasons:

• http_ssl_binding_deleted: the binding for an endpoint being removed outright
• tls_cert_expired: a certificate this host presented having passed its validity period

hyperv_vswitch_config_restore_failed

Hyper-V virtual switch failed to restore port configuration.

Severity: Error or Warning (server or unknown) / Info (workstation)

Impact: Virtual networking may not restore correctly for a VM, vNIC, WSL switch, or host virtual adapter.

Channel: System

Provider: Microsoft-Windows-Hyper-V-VmSwitch

Event ids: 15

Where to look next:

• Check the virtual switch or port name in the raw event.
• On servers, correlate with VM connectivity complaints.

iis_apppool_disabled

An IIS application pool was disabled by rapid-fail protection.

Severity: Serious (server or unknown) / Warning (workstation)

Impact: The application pool can return 503 responses until an operator fixes and re-enables it.

Channel: System

Provider: Microsoft-Windows-WAS

Event ids: 5002

Where to look next:

• Identify the application pool.
• Check preceding worker crashes or startup failures.

iis_apppool_identity_invalid

IIS reported that an application pool's configured identity is invalid or cannot be resolved.

Severity: Error or Warning

Impact: The affected application pool may fail to start or serve requests under its configured identity.

Channel: System

Provider: Microsoft-Windows-WAS

Event ids: 5021, 5057

Where to look next:

• Verify the app pool's configured credentials or identity.
• Correlate with IIS worker crashes and HTTP 503 reports.

Related reasons:

• iis_apppool_worker_start_failed: the worker process itself failing to start, a different fact

iis_apppool_worker_start_failed

IIS reported that an application pool's worker process failed to start.

Severity: Error or Warning

Impact: The affected application pool may fail to serve requests until the worker starts successfully.

Channel: System

Provider: Microsoft-Windows-WAS

Event ids: 5059

Where to look next:

• Check recent configuration or credential changes to the app pool.
• Correlate with IIS worker crashes and HTTP 503 reports.

Related reasons:

• iis_apppool_identity_invalid: the app pool's configured identity being invalid, a different fact

iis_worker_crash

An IIS worker process terminated unexpectedly.

Severity: Warning

Impact: Requests handled by that worker may fail or reset; repeated crashes can degrade the site or app pool.

Channel: System

Provider: Microsoft-Windows-WAS

Event ids: 5009, 5011

Where to look next:

• Identify the application pool and worker process.
• Correlate with Application-channel crash events.

kerberos_cert_domain_unresolved

Kerberos could not resolve the domain named in a certificate offered for sign-in.

Severity: Info (capped)

Impact: On a domain-joined device, certificate or smart-card sign-in for that domain does not complete. On a cloud-joined or standalone device the same message is routine and expected.

Channel: System

Provider: Microsoft-Windows-Security-Kerberos

Event ids: 11

Where to look next:

• Confirm whether the device is joined to the domain named in the certificate.
• On domain-joined devices, check domain controller reachability and DNS from this host.

The same code path serves physical smart cards, virtual smart cards and Windows Hello for Business, so the message is not evidence that a physical card is in use.

kerberos_etype_unsupported

A Kerberos exchange failed because the encryption types the client, the service account and the domain controller support do not overlap.

Severity: Warning

Impact: The affected client or service cannot obtain the ticket it asked for and falls back or fails. Accounts left in this state stop authenticating once the legacy encryption types are refused outright.

Channel: System

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

Event ids: 16, 203

Where to look next:

• Read the account and the requested encryption types from the message.
• Set the supported encryption types on the service account, or reset its password so a modern key is generated.
• Identify legacy clients and appliances before the weak types are refused outright.

Related reasons:

• kerberos_ticket_failed: the client-side record of a ticket request that did not succeed
• kerberos_weak_krbtgt_key: the same legacy-cryptography problem on the ticket-granting account itself

kerberos_pac_verify_failed

A domain controller could not verify the signature on the privilege data inside a Kerberos ticket.

Severity: Warning

Impact: The request carrying that ticket did not proceed. A client presenting the same ticket repeatedly keeps failing to authenticate to the affected service.

Channel: System

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

Event ids: 18

Where to look next:

• Compare the update level of every domain controller in the domain before reading this as an attack.
• Note which account the message names and whether the pattern follows one client or many.

Related reasons:

• kerberos_etype_unsupported: another Kerberos exchange failure, over encryption types rather than signatures

kerberos_smartcard_cert_missing

A domain controller has no usable certificate for smart card logon.

Severity: Warning

Impact: Certificate-based logon does not work against this domain controller. Other authentication methods are unaffected.

Channel: System

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

Event ids: 19, 29

Where to look next:

• Confirm whether smart card or certificate logon is in use in this domain before acting.
• Check the domain controller certificate template, its enrolment, and the chain to the issuing authority.

Related reasons:

• cert_enroll_failed: the enrolment failure that leaves a controller without its certificate
• kerberos_cert_domain_unresolved: the client-side half of a certificate logon that could not proceed

kerberos_weak_krbtgt_key

The domain ticket-granting account has no strong encryption key, so Kerberos tickets are issued using legacy cryptography.

Severity: Warning

Impact: Domain authentication is protected by weaker cryptography than it should be, and the domain stops issuing usable tickets once the legacy encryption types are refused.

Channel: System

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

Event ids: 42

Where to look next:

• The remedy is a password update on the ticket-granting account, performed the documented way.
• Plan it before legacy encryption types are refused outright.

Related reasons:

• kerberos_etype_unsupported: the same legacy-cryptography problem on ordinary service accounts

nic_driver_fault_reported

A loaded wireless network adapter driver reported a fault in the adapter or in itself.

Severity: Warning

Impact: Wireless connectivity on that adapter is lost or unreliable for as long as the fault lasts. The driver normally resets and reloads itself without anyone acting.

Channel: System

Provider: Intel wireless NDIS miniports (Netwtw* and Netwaw* adapter generations)

Event ids: 5002, 5005

Where to look next:

• Check whether the driver wrote an initialization record afterwards, which means it recovered.
• Repeats on one host point at the adapter, its firmware or the driver version.

Related reasons:

• nic_driver_load_failed: the driver failing to load at all, which no reset recovers
• nic_link_down: a working adapter reporting its link lost, which is a different fact
• wlan_limited_connectivity: the Windows wireless service reporting the connection degraded

nic_driver_load_failed

A wireless network adapter driver could not load, normally because of a resource conflict.

Severity: Error

Impact: The adapter is absent from the network stack until it is fixed. Nothing on the host retries the load.

Channel: System

Provider: Intel wireless NDIS miniports (Netwtw* and Netwaw* adapter generations)

Event ids: 5000

Where to look next:

• A driver that could not load is normally a resource conflict, a disabled device or a bad install.
• Check whether the host has another adapter carrying its traffic.

Related reasons:

• driver_load_failed: the same class of failure for drivers outside this adapter family
• nic_driver_fault_reported: a loaded driver reporting a fault, which normally resets itself
• nic_link_down: a working adapter reporting its link lost, which is a different fact

nic_link_down

A network adapter reported that its link went down, or reported the link back (RECOVERED).

Severity: Warning or Info

Impact: Traffic on that adapter stops until the link returns. A host with another working adapter stays reachable; a host with only this one is offline for the duration.

Channel: System

Provider: Intel NDIS miniports (e1i68x64 and the sibling adapter generations, e2fnexpress), bnxtnd

Event ids: 2, 27

Case	Severity	Ticket class
down	Warning	networking
recovered	Info	networking

Where to look next:

• Look for the matching link-up record and read the gap between them.
• Repeated drop-and-return cycles on one adapter point at the cable, the port or the switch.

Related reasons:

• nic_driver_fault_reported: the driver reporting a fault in itself rather than a state of the link

os_bsod

Windows rebooted from a bugcheck.

Severity: Serious (server or unknown) / Error (workstation)

Impact: The host crashed and rebooted; the dump may be needed for driver, hardware, or kernel analysis.

Channel: System

Provider: Microsoft-Windows-WER-SystemErrorReporting

Event ids: 1001

Where to look next:

• Preserve the dump path and bugcheck code.
• Search the bugcheck_name: it is the name Microsoft documents the stop code under.
• Correlate with Kernel-Power 41 and EventLog 6008.

Related reasons:

• kernel_crash: one row per kernel crash with the decoded code and any dump analysis; count crashes from it, not from this record

Fields it can set: win.eventlog.system.bugcheck_name, win.eventlog.system.bugcheck_text, win.eventlog.system.dump_file, win.eventlog.system.report_id

patch_install_deferred

Windows Update deferred an install attempt on this device; nothing failed.

Severity: Info or Verbose

Impact: The update is retried automatically on a later cycle. No durable state changed.

Channel: System

Provider: Microsoft-Windows-WindowsUpdateClient

Event ids: 20

Case	Severity	Ticket class
packages_in_use	Verbose	patching
retry_later	Info	patching

Where to look next:

• No action needed on a single instance; the client retries automatically.
• Group by update title across the fleet if one update defers repeatedly.

Related reasons:

• patch_install_failed: the same event id when the install actually failed, a different fact

Fields it can set: win.eventlog.system.update_title

The raw result code and update title ride the message tail; the normalized code and its space ride the shared error fields.

patch_install_failed

Windows Update reports an install attempt on this device that stopped or failed.

Also reported by: Windows Setup event log

Severity: Minor or Info

Impact: On a failure the device stays on the previous version of that update until a later attempt succeeds, and repeated failures on the same update mean the device is falling behind on patching. On the interrupted outcome nothing changed and the update is offered again.

Channel: System

Provider: Microsoft-Windows-WindowsUpdateClient

Event ids: 20

Case	Severity	Ticket class
interrupted	Info	patching
failed	Minor	patching

Where to look next:

• Check whether a later attempt at the same update succeeded.
• Group by the update title across the fleet to separate a bad update from a device problem.
• Group by the result code to separate one failure cause from another.

Related reasons:

• patch_install_deferred: the same event id when the install was in-use or waiting, a different fact

Fields it can set: win.eventlog.system.update_title

A single failure is common and usually self-correcting. Recurrence across cycles on the same update is the actionable pattern. The update title and the result code ride the message tail, and the normalized code and its space ride the shared error fields.

platform_tamper_indicator_reported

A platform-security agent reported a tamper indicator against this machine.

Also reported by: Windows platform event channels

Severity: Error or Warning

Impact: The agent names the category it matched and the firmware or chassis events it built the indicator from. An indicator names what the agent matched; read the named settings to see what the machine is actually set to.

Channel: System

Provider: Dell Trusted Device | BIOS Events and IoA

Event ids: 11, 12

Case	Severity	Ticket class
partial	Warning	endpoint_protection
escalated	Error	endpoint_protection
detected	Error	endpoint_protection
reported	Warning	endpoint_protection

Where to look next:

• Read the Category and the listed events from the message: they name what was matched.
• Check whether a deliberate BIOS change or a hardware service visit explains it.
• Where nothing explains it, treat the named firmware settings as the thing to put back.

Related reasons:

• av_unsigned_code_blocked: an endpoint agent blocking code it could not verify

rds_license_server_unactivated

A Remote Desktop license server is not activated and is issuing only temporary licences.

Severity: Warning

Impact: Remote Desktop clients receive temporary licences that expire. Once they do, sessions are refused until the license server is activated.

Channel: System

Provider: Microsoft-Windows-TerminalServices-Licensing

Event ids: 18

Where to look next:

• Activate the license server named in the message through its own management console.
• Check which licence model and how many licences the server is configured for while there.

Related reasons:

• rds_license_tracking_failed: the license server unable to record licence issue in the directory
• rds_licensing_service_failed: the same license server unable to run at all

rds_license_tracking_failed

A Remote Desktop license server could not record a per-user licence in the directory.

Severity: Warning

Impact: Per-user licence tracking is incomplete for the affected users. Sessions still work, so the gap is only visible when licence usage is audited.

Channel: System

Provider: Microsoft-Windows-TerminalServices-Licensing

Event ids: 4105

Where to look next:

• Add the license server computer account to the licence-servers group the message names.
• Re-check licence usage reporting afterwards, since earlier issues were not recorded.

Related reasons:

• rds_license_server_unactivated: the same server issuing only temporary licences

rds_licensing_service_failed

A Remote Desktop license server could not run, or hit an error in its licensing database.

Severity: Error

Impact: New Remote Desktop client access licences are not being issued reliably by this server. Existing licences keep working until they expire.

Channel: System

Provider: Microsoft-Windows-TerminalServices-Licensing

Event ids: 37, 44, 4097

Case	Severity	Ticket class
start_failed	Error	licensing
database_error	Error	licensing

Where to look next:

• Read the error the message names before restarting anything.
• Check whether the deployment has a second license server still answering.
• A database engine error normally means the licensing store needs repair or rebuild.

Related reasons:

• rds_license_server_unactivated: a license server that runs but issues only temporary licences
• rds_license_tracking_failed: a license server unable to record licence issue in the directory

secure_boot_cert_update_pending

A Secure Boot certificate update has not been applied on this device.

Severity: Warning

Impact: Boot trust material stays stale, which can block future firmware or OS updates and leave the device on superseded Secure Boot certificates.

Channel: System

Provider: Microsoft-Windows-TPM-WMI

Event ids: 1801

Where to look next:

• Check pending firmware and servicing updates on the device.
• Confirm Secure Boot state after the next update cycle.

Related reasons:

• tpm_attestation_failed: Same provider; device trust and firmware posture

security_agent_service_start_failed

A sub-service of an endpoint protection agent failed to start.

Severity: Warning

Impact: The named component of the security product is not running. Where the component belongs to this installation, the agent is operating without part of its function.

Channel: System

Provider: McAfee Service Controller

Event ids: 6

Where to look next:

• Read the reason the supervisor states; a missing file is usually a component this edition does not ship.
• Confirm from the product console whether the named component is expected on this host.

Related reasons:

• security_agent_service_terminated: the same supervisor reporting a component that died while running
• service_start_failed: the Windows service controller reporting the same class of failure

security_agent_service_terminated

A sub-service of an endpoint protection agent terminated unexpectedly.

Severity: Minor

Impact: The named component of the security product stopped. The agent normally restarts it, so a single occurrence usually leaves protection intact; a host emitting these continuously is running a broken install.

Channel: System

Provider: McAfee Service Controller

Event ids: 5

Where to look next:

• Count occurrences per host: the rate is the signal, not one event.
• Name the sub-service from the message and check whether it is expected on this build.
• A host looping on this normally needs the agent reinstalled.

Related reasons:

• security_agent_service_start_failed: the same supervisor reporting a component that never started
• service_crashed: the Windows service controller reporting the same class of failure

service_crashed

A Windows service crashed or terminated unexpectedly.

Severity: Error

Impact: The service may be unavailable, degraded, or flapping until it restarts cleanly.

Channel: System

Provider: Service Control Manager

Event ids: 7031, 7034

Where to look next:

• Group by service_name and crash_count.
• Look for vendor service names that point to backup, RMM, security, or line-of-business software.

Fields it can set: win.eventlog.system.crash_count, win.eventlog.system.service_name

service_exited_with_error

A Windows service exited with an error.

Severity: Error

Impact: The affected service may not be delivering its role until the underlying service error is fixed.

Channel: System

Provider: Service Control Manager

Event ids: 7023, 7024

Where to look next:

• Record the service-specific error code or message.
• Check whether a later start succeeded.

Fields it can set: win.eventlog.system.service_error, win.eventlog.system.service_name

service_hang

A Windows service stopped responding to a control transaction.

Severity: Error

Impact: A hung service can block dependent work or delay shutdown, startup, or control operations.

Channel: System

Provider: Service Control Manager

Event ids: 7011

Where to look next:

• Identify the named service and transaction timeout.
• Check for adjacent service crashes or resource pressure.

Fields it can set: win.eventlog.system.service_name

service_installed

A Windows service was installed.

Also reported by: Windows Security event log

Severity: Notice

Impact: Unexpected service creation can establish persistence or run code under a privileged account.

Channel: System

Provider: Service Control Manager

Event ids: 7045

Example

A service was installed in the system.

channel: System
provider_name: Service Control Manager
event_id: 7045
event_data.ServiceName: ExampleSvc
event_data.ImagePath: "C:\Program Files\Example\svc.exe"
event_data.ServiceType: user mode service
event_data.StartType: auto start
event_data.AccountName: LocalSystem

SparkLogs: service_installed, Notice, service_installed: NOTABLE: A service was installed in the system.

Where to look next:

• Review ServiceName, ImagePath, StartType, ServiceType, and AccountName.
• Compare with approved software install windows.

Fields it can set: command_line, win.eventlog.system.account_name, win.eventlog.system.image_path, win.eventlog.system.service_name, win.eventlog.system.service_type, win.eventlog.system.start_type

service_start_failed

A Windows service failed to start.

Severity: Error

Impact: The service is unavailable until startup succeeds or its dependency error is fixed.

Channel: System

Provider: Service Control Manager

Event ids: 7000

Where to look next:

• Review the service error and dependencies.
• Check for paired timeout or account logon failures.

Fields it can set: win.eventlog.system.service_error, win.eventlog.system.service_name

service_start_timeout

A Windows service did not connect before the startup timeout.

Severity: Error

Impact: The service may be unavailable or too slow to initialize under current load or dependency state.

Channel: System

Provider: Service Control Manager

Event ids: 7009

Where to look next:

• Pair with SCM 7000 or 7011 for the same service.
• Check whether timeout policy, dependencies, or service account issues changed.

Fields it can set: win.eventlog.system.service_name

smb_delayed_write_lost

Windows could not save cached file data to a network share and the data was lost.

Severity: Error

Impact: Data an application believed it had written to a share was discarded. The application is not told. Repeated occurrences point at the link to the file server.

Channel: System

Provider: mrxsmb, Mup, mrxsmb10, mrxsmb20

Event ids: 50, 139

Where to look next:

• Check the link to the file server, and whether the server restarted under open handles.
• Read the rate rather than one instance: a steady stream means the session keeps dropping.

Related reasons:

• filesystem_delayed_write_lost: the same loss for a file on a local volume

smb_server_transport_bind_failed

The Windows file-sharing service could not bind to a network transport.

Severity: Warning (server) / Info (workstation)

Impact: On a file server, clients may not reach shares over the affected transport. On a workstation this normally accompanies a network adapter appearing or disappearing.

Channel: System

Provider: Server

Event ids: 2504

Where to look next:

• Identify the transport device from the message; NetBT paths name the adapter GUID.
• On a server, confirm shares are reachable on every address clients use.

smb_share_recreate_failed

A file share could not be recreated because the folder it points at no longer exists.

Severity: Warning

Impact: Clients and scripts using that share name fail to connect until the folder is restored or the share definition is removed.

Channel: System

Provider: Server

Event ids: 2511

Where to look next:

• Read the share name and path from the message; the event names both remedies.
• Check whether the folder was moved rather than deleted before removing the share.

storage_controller_reset

The AHCI storage controller reported a reset or timeout condition.

Also reported by: Windows storage event channels

Severity: Warning

Impact: A controller reset can stall storage IO and may indicate a failing device, cable, controller, or driver path.

Channel: System

Provider: storahci

Where to look next:

• Confirm the exact storahci event id and message on the affected host.
• Correlate with disk retry and paging errors.

time_sync_failed

Windows Time could not reach or resolve its time source.

Severity: Warning

Impact: Clock skew can break Kerberos, TLS validation, scheduled jobs, and timeline analysis.

Channel: System

Provider: Microsoft-Windows-Time-Service

Event ids: 134

Where to look next:

• Check the configured peer and DNS result.
• Correlate with authentication or certificate errors.

Fields it can set: win.eventlog.system.time_peer

tls_cert_expired

A remote server presented a certificate that has expired or is not yet valid, and the TLS connection failed.

Severity: Error

Impact: The connection to that endpoint does not complete, and retrying does not help until the certificate is renewed or the local clock is corrected.

Channel: System

Provider: Schannel

Event ids: 36881

Where to look next:

• Identify the endpoint from the calling process and confirm its certificate validity dates.
• Check the local clock: a host with a wrong date rejects valid certificates this way.

Related reasons:

• tls_cert_name_mismatch: the same rejection for a name that does not match
• tls_cert_untrusted_ca: the same rejection for an issuer the host does not trust

tls_cert_name_mismatch

A TLS certificate name did not match the expected server name.

Severity: Error

Impact: TLS connections may fail or users may be exposed to misconfiguration or impersonation risk.

Channel: System

Provider: Schannel

Event ids: 36884

Where to look next:

• Verify the requested hostname and certificate subject/SAN.
• Check whether the peer is expected for the application.

tls_cert_untrusted_ca

A remote server presented a certificate issued by an authority this host does not trust, and the TLS connection failed.

Severity: Error

Impact: The connection to that endpoint does not complete. Nothing in the presented certificate can be relied on, so the identity of the peer is unestablished.

Channel: System

Provider: Schannel

Event ids: 36882

Where to look next:

• Check whether a TLS-inspecting appliance or proxy is in the path and whether its authority is deployed to this host.
• Confirm the endpoint is one this host is meant to reach.

Related reasons:

• tls_cert_expired: the same rejection for a certificate outside its validity window
• tls_cert_name_mismatch: the same rejection for a name that does not match

tls_cipher_mismatch

A remote client offered no cipher suite this host accepts, and the TLS handshake failed.

Severity: Warning

Impact: The client cannot connect to this host over TLS. The host itself is unaffected and continues serving clients that offer a supported suite.

Channel: System

Provider: Schannel

Event ids: 36874

Where to look next:

• Identify the clients still offering obsolete suites before the remaining legacy suites are withdrawn.
• Steady low-rate volume from unknown sources is usually scanning rather than a real client.

Related reasons:

• kerberos_etype_unsupported: the same legacy-cryptography problem inside Kerberos

tls_client_credential_failed

The host could not create a TLS client credential, so a connection that needed to present a client certificate could not build one.

Severity: Error (server) / Warning (workstation)

Impact: The application that asked for the credential cannot complete authenticated TLS connections that require one. Connections that present no client certificate are unaffected.

Channel: System

Provider: Schannel

Event ids: 36871

Where to look next:

• Read the requesting process from the message and identify which integration needs a client certificate.
• Check that the certificate exists in the expected store and that its private key is readable by the calling account.

Related reasons:

• cert_enroll_failed: a certificate that never arrived, as opposed to one that cannot be used
• tls_server_credential_failed: the same class of failure on the credential this host serves with

tls_server_credential_failed

The private key behind this host's TLS server certificate could not be accessed.

Severity: Error

Impact: Clients cannot negotiate TLS with the endpoint that uses that certificate until the key or its permissions are repaired.

Channel: System

Provider: Schannel

Event ids: 36870

Where to look next:

• Check the private key permissions for the certificate the affected service is bound to.
• Confirm the key container survived the last certificate renewal or import.

Related reasons:

• tls_client_credential_failed: the same class of failure on an outbound client credential

tpm_attestation_failed

TPM attestation failed for a critical component.

Severity: Error

Impact: Device trust or security posture checks may fail until TPM or firmware state is corrected.

Channel: System

Provider: Microsoft-Windows-TPM-WMI

Event ids: 1040

Where to look next:

• Check TPM health and Secure Boot posture.
• Correlate with firmware or dbx update events.

unexpected_shutdown

The previous shutdown was not clean: the host stopped without shutting down and came back on the next start.

Severity: Serious or Error on a server or an unknown host class, depending on which record reports it and what level that record carried; Warning on a workstation.

Impact: Unclean shutdown can interrupt workloads, lose in-memory state, and leave storage or applications needing recovery. It also complicates incident timelines.

Channel: System

Provider: EventLog, Microsoft-Windows-Kernel-Power

Event ids: 41, 6008

Case	Severity	Ticket class	Event ids
event_log	Warning to Serious	os_stability
kernel_power	Warning to Error	os_stability	41

Where to look next:

• Use with os_bsod as the crash triangle around one boot gap.
• Inspect bugcheck_code and bugcheck_name when present: a nonzero code means a bug check ended the session; a zero code leaves the cause undetermined.
• The row time is the next boot, not the moment the host stopped.
• Check the nearest clean shutdown and boot markers.

Related reasons:

• kernel_crash: one row per kernel crash, whichever records report it; count crashes from it, not from these rows
• os_bsod: the crash that caused some of these, which is a different fact

Fields it can set: win.eventlog.system.bugcheck_code, win.eventlog.system.bugcheck_name, win.eventlog.system.connected_standby_in_progress, win.eventlog.system.sleep_in_progress

vpn_connected

A remote-access connection was established.

Severity: Notice

Channel: System

Provider: RasMan

Event ids: 20267

Where to look next:

• Read the profile name and the user from the message.
• Read it beside the failures on the same host to tell a retry from a broken tunnel.

Related reasons:

• vpn_dial_failed: a dial attempt that did not connect, which this is the counterpart to

vss_shadow_aborted

A volume shadow-copy operation was aborted by shadow storage limits.

Severity: Error or Warning

Impact: A backup or restore-point operation may have lost its usable snapshot.

Channel: System

Provider: Volsnap

Event ids: 13, 14, 15, 16, 20, 23, 24, 27, 28, 29, 32, 35, 36

What you see: A Volsnap event in the System log saying the shadow copies of a volume were aborted, or that a new one was not created, with the cause in the same sentence: a configured storage limit, an IO failure, a storage volume that is not present, paged heap exhausted, or the shadow copy storage failing to grow.

What it means: The snapshot in flight is gone; the restore point that depended on it does not exist. The two storage-growth events are the exception: they forecast risk to existing copies, not a loss yet. A configured ceiling, not a fault, leaves the same missing restore point and recurs every cycle until the limit changes.

What to do: Confirm from the backup product whether the job retried or fell back, then review the shadow storage size against how much the volume changes between snapshots.

When to ignore it: One aborted snapshot alone is not evidence of lost recovery points; that condition is a run of these over days, not a single event.

References:

• Microsoft Learn - vssadmin resize shadowstorage: The shadow storage size and per-volume limit the storage causes here run into.

Example

The shadow copies of volume G: were aborted because of an IO failure on volume G:.

channel: System
provider_name: Volsnap
event_id: 14
event_data.VolumeName: G:

SparkLogs: vss_shadow_aborted, Error, vss_shadow_aborted: NOTABLE: The shadow copies of volume G: were aborted because of an IO failure on volume G:.

Case	Severity	Ticket class
storage_limit_reached	Error	backup
abort_on_failure	Error	backup
storage_growth_failed	Warning	backup

Where to look next:

• Confirm whether the backup job retried or fell back successfully.
• Review shadow storage sizing and churn.

Related reasons:

• vss_snapshots_failing_for_space
• vss_writer_failed (Windows Application event log, VSS writers)

Fields it can set: win.eventlog.system.volume

vss_snapshots_failing_for_space

Volume shadow copies were deleted because shadow storage could not grow.

Also reported by: Windows Application event log, VSS shadow storage

Severity: Error

Impact: Restore points or backup recovery sources may be missing for the affected volume.

Channel: System

Provider: Volsnap

Event ids: 25

What you see: A Volsnap event in the System log saying the shadow copies of a volume were deleted because the shadow copy storage could not grow in time.

What it means: Copies that existed are gone: the restore points a customer believed they had are the ones deleted. This is the one Volsnap event that states a completed loss, not a risk of one, and the shortfall shows up at restore time. A host that logs it has a real shadow storage sizing or IO problem, not routine housekeeping.

What to do: Check the backup job outcomes around the event time, then raise the shadow storage limit for the volume or reduce what it has to hold.

When to ignore it: Routine reclamation of the oldest copy to stay under a count limit is a different Volsnap event.

References:

• Microsoft Learn - vssadmin resize shadowstorage: The per-volume shadow storage allocation that could not grow.

Example

The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.

channel: System
provider_name: Volsnap
event_id: 25
event_data.VolumeName: C:

SparkLogs: vss_snapshots_failing_for_space, Error, vss_snapshots_failing_for_space: NOTABLE: The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.

Where to look next:

• Check backup job outcomes near the event time.
• Review shadow storage limits for the affected volume.

Related reasons:

• vss_shadow_aborted

Fields it can set: win.eventlog.system.volume

win_app_error_dialog_shown

An application error popup was recorded.

Severity: Minor

Impact: A foreground or service application may have failed and required user or operator attention.

Channel: System

Provider: Application Popup

Event ids: 26

Where to look next:

• Read the popup text in the raw message.
• Look for nearby application crash records.

winre_servicing_failed

Servicing of the Windows recovery environment failed on this device.

Severity: Error

Impact: The recovery environment stays at its previous state, and updates that depend on servicing it can keep failing; the most common cause is a recovery partition with too little free space.

Channel: System

Provider: Microsoft-Windows-WinREAgent

Event ids: 4502

Where to look next:

• Check free space on the recovery partition.
• Check whether later update attempts on this device fail the same way.

Related reasons:

• patch_install_failed: Update installs can keep failing while recovery servicing is broken

wlan_limited_connectivity

Wireless networking entered limited connectivity.

Severity: Warning

Impact: The host may lose network reachability or degrade user sessions until wireless connectivity recovers.

Channel: System

Provider: Microsoft-Windows-WLAN-AutoConfig

Event ids: 4003

Where to look next:

• Look for recurrence on the same adapter or SSID.
• Correlate with DNS timeouts and DHCP renewal failures.

Vocabularies

These token sets are closed: a value outside the set leaves its field unset instead of invented.

cper_severity_word

The severity a WHEA-Logger 1 hardware error record states in its own header, in plain words: unrecoverable is what the header calls fatal, recoverable is uncorrected but contained.

• unrecoverable
• recoverable
• corrected
• informational

cper_where_first

Where the error details of a WHEA-Logger 1 record are. details_in_firmware: every section is a firmware error record reference, so the details stay in the platform firmware and are not in the event. Otherwise the first of up to three kinds of error section the record carries, in this order: memory, pcie, processor (processor generic and IA32/x64 machine check), generic, firmware (a firmware reference beside other sections), unrecognized (a section type with no published name).

• details_in_firmware
• memory
• pcie
• processor
• generic
• firmware
• unrecognized

cper_where_second

The second kind of error section a WHEA-Logger 1 record carries, in the same fixed order as cper_where_first.

• pcie
• processor
• generic
• firmware
• unrecognized

cper_where_third

The third kind of error section a WHEA-Logger 1 record carries, in the same fixed order as cper_where_first.

• processor
• generic
• firmware
• unrecognized

reclaim_cause

Which ceiling the volume snapshot driver was holding to when it reclaimed the oldest shadow copy: the disk space shadow copies may occupy on the volume, the number of shadow copies that may exist for it, or copies already marked for deletion being cleared so that newer ones can be kept. The three are the axes to compare when a restore point a customer expected is missing.

• space_limit
• count_limit
• delete_pending

shutdown_cause

What ended the previous session, as far as Kernel-Power 41 states it. bugcheck means the record carries a nonzero bug check code. undetermined means it carries none: a power loss, a hang or a held power button all read the same, so no cause is claimed.

• bugcheck
• undetermined

Ask this feed a question

Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.