Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
Endpoint added.
Name: N-H2-765311-3
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{F91FD907-371A-45C2-B759-87A476CAF09B}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 78 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 4220 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:55:35 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint removed.
Name:
Domain Name:
Transport Name: \Device\NetBT_Tcpip_{C194C58B-3D12-4D73-97F1-07FDBC3086EE}
Guidance:
You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. | 1011 | 0 | | 4 | 1011 | 0 | 2305843009213693960 | 77 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:42:51 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.
Guidance:
You should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. | 1027 | 0 | | 4 | 1027 | 0 | 2305843009213693960 | 76 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 2432 | 2508 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::5062:cad8:c14d:af4a
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 75 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 10.222.0.66
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 74 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::3124:dbba:2a37:9787
Flags: 0x1
Interface Index: 4
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 73 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.0.69
Flags: 0x1
Interface Index: 4
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 72 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: N-H2-765311-3
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{9323EC14-9EB3-462E-B994-866CB2782DBA}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 71 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: N-H2-765311-3
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{C194C58B-3D12-4D73-97F1-07FDBC3086EE}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 70 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:16 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: N-H2-765311-3
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 69 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | n-h2-765311-3 | S-1-5-18 | 12/6/2020 6:40:13 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.
Guidance:
You should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. | 1027 | 0 | | 4 | 1027 | 0 | 2305843009213693960 | 68 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 2192 | 2248 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::5062:cad8:c14d:af4a
Flags: 0x1
Interface Index: 4
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 67 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 10.222.0.66
Flags: 0x1
Interface Index: 4
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 66 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::3124:dbba:2a37:9787
Flags: 0x1
Interface Index: 3
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 65 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.0.69
Flags: 0x1
Interface Index: 3
Capability: 0x1
Link Speed: 20000000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 64 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-KHURBH91U3B
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{9323EC14-9EB3-462E-B994-866CB2782DBA}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 63 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:28 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-KHURBH91U3B
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{C194C58B-3D12-4D73-97F1-07FDBC3086EE}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 62 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 224 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:25 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-KHURBH91U3B
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 61 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 220 | WIN-5T344G8GM1H | S-1-5-18 | 12/6/2020 6:38:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint removed.
Name:
Domain Name:
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Guidance:
You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. | 1011 | 0 | | 4 | 1011 | 0 | 2305843009213693960 | 60 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 212 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 59 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:44:31 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint removed.
Name:
Domain Name:
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Guidance:
You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. | 1011 | 0 | | 4 | 1011 | 0 | 2305843009213693960 | 58 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:44:18 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 57 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 56 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 55 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 54 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 53 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 52 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 51 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 50 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 49 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 48 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:16 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 47 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:44 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 46 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:44 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 45 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:44 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 44 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:44 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 43 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:41 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 42 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 41 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 40 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 39 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 38 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:01 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 37 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:19:22 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint removed.
Name:
Domain Name:
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Guidance:
You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. | 1011 | 0 | | 4 | 1011 | 0 | 2305843009213693960 | 36 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 3588 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:19:16 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 35 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:11:51 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint removed.
Name:
Domain Name:
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Guidance:
You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. | 1011 | 0 | | 4 | 1011 | 0 | 2305843009213693960 | 34 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 3588 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:11:38 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 33 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:52 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 32 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:52 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 31 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:52 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 30 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:52 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 29 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 360 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 28 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:06 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::6df4:53fe:c824:2937
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 27 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:06 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.3
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 26 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:06 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 25 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:06 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 24 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:03 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{518CDFA4-5492-4D9E-BEAA-908825A4A289}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 23 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:03 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 22 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:57 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.
Guidance:
You should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. | 1027 | 0 | | 4 | 1027 | 0 | 2305843009213693960 | 21 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 1892 | 2056 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:56 AM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 20 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:28 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 19 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:28 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.10
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 18 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:28 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 17 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:28 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 16 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:25 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 15 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 204 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:14 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 14 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 204 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:14 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.10
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 13 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 204 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:14 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 12 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 204 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:14 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 11 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 204 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.
Guidance:
You should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. | 1027 | 0 | | 4 | 1027 | 0 | 2305843009213693960 | 10 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 2100 | 2132 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662::1
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 9 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 2a02:2f09:33b0:1662:e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 8 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: fe80::e432:d3ed:b94f:1d5e
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 7 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The network name information changed.
Change Type: Add
Net Name: *
IP Address: 192.168.1.10
Flags: 0x1
Interface Index: 2
Capability: 0x1
Link Speed: 150000000
Guidance:
You should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. | 1012 | 0 | | 4 | 1012 | 0 | 2305843009213693960 | 6 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 5 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 380 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:02 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-5T344G8GM1H
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 4 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 380 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:59 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-PD8DQPRRTAO
Domain Name: WORKGROUP
Transport Name: \Device\NetBT_Tcpip_{5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 3 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 2552 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:27 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Endpoint added.
Name: WIN-PD8DQPRRTAO
Domain Name: WORKGROUP
Transport Name: \Device\NetbiosSmb
Transport Flags: 0x1
Guidance:
You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. | 1010 | 0 | | 4 | 1010 | 0 | 2305843009213693960 | 2 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 4 | 208 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:21 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.
Guidance:
You should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. | 1027 | 0 | | 4 | 1027 | 0 | 2305843009213693960 | 1 | Microsoft-Windows-SMBServer | d48ce617-33a2-4bc3-a5c7-11aa4f29619e | Microsoft-Windows-SMBServer/Operational | 1036 | 1940 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:16 PM | | | microsoft-windows-smbserver/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |