|
|
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <lm.h>
#define MAX_DB_EINTRIES 256
#define MAX_SUB_STRINGS 8
#define MAX_SUB_STR_LEN 128
#define MAX_DESC_LEN 2048
#define SIZE_EVENT_BUFFER 0x8000
typedef struct _DBENTRY{ DWORD dwID; DWORD dwTimeFirst; DWORD dwTimeLast; DWORD dwCount; char szSource[64]; char szDescription[MAX_DESC_LEN]; DWORD dwNumStrings; char szStrings[MAX_SUB_STRINGS][MAX_SUB_STR_LEN]; } DBENTRY, *PDBENTRY;
typedef enum { ePlaceHolder, eDbg, eCon, eBoth } OUTPUTS;
#define SplitPrint() \
if (enumOutput & eDbg) \ DbgPrint(sp);\ if (enumOutput & eCon)\ printf(sp)
char sp[256]; OUTPUTS enumOutput=eCon; BOOLEAN bRemote = FALSE; BOOLEAN bFirst = TRUE; char szRemoteComputer[128]; HKEY hRegistry = 0;
DbgPrint(PCH x,...); void InitializeDatabase(void); PDBENTRY SearchDatabase(PEVENTLOGRECORD); PDBENTRY AddToDatabase(PEVENTLOGRECORD); PDBENTRY UpdateDatabase(PEVENTLOGRECORD,PDBENTRY); void DumpDatabase(void); void CleanupDatabase(void); void Usage(void); void PrintEventLogRecord(PEVENTLOGRECORD pelrEvent);
PDBENTRY Database[MAX_DB_EINTRIES];
char szLogType[128] = "System";
typedef struct _FRS_EL_ENTRY{ DWORD EventId; PCHAR EventTag; } FRS_EL_ENTRY, *PFRS_EL_ENTRY;
FRS_EL_ENTRY FrsEvents[] = { {13500 , "EVENT_FRS_ERROR"}, {13501 , "EVENT_FRS_STARTING"}, {13502 , "EVENT_FRS_STOPPING"}, {13503 , "EVENT_FRS_STOPPED"}, {13504 , "EVENT_FRS_STOPPED_FORCE"}, {13505 , "EVENT_FRS_STOPPED_ASSERT"}, {13506 , "EVENT_FRS_ASSERT"}, {13507 , "EVENT_FRS_VOLUME_NOT_SUPPORTED"}, {13508 , "EVENT_FRS_LONG_JOIN"}, {13509 , "EVENT_FRS_LONG_JOIN_DONE"}, {13510 , "EVENT_FRS_CANNOT_COMMUNICATE"}, {13511 , "EVENT_FRS_DATABASE_SPACE"}, {13512 , "EVENT_FRS_DISK_WRITE_CACHE_ENABLED"}, {13513 , "EVENT_FRS_JET_1414"}, {13514 , "EVENT_FRS_SYSVOL_NOT_READY"}, {13515 , "EVENT_FRS_SYSVOL_NOT_READY_PRIMARY"}, {13516 , "EVENT_FRS_SYSVOL_READY"}, {13517 , "EVENT_FRS_ACCESS_CHECKS_DISABLED"}, {13518 , "EVENT_FRS_ACCESS_CHECKS_FAILED_USER"}, {13519 , "EVENT_FRS_ACCESS_CHECKS_FAILED_UNKNOWN"}, {13520 , "EVENT_FRS_MOVED_PREEXISTING"}, {13521 , "EVENT_FRS_CANNOT_START_BACKUP_RESTORE_IN_PROGRESS"}, {13522 , "EVENT_FRS_STAGING_AREA_FULL"}, {13523 , "EVENT_FRS_HUGE_FILE"}, {13524 , "EVENT_FRS_CANNOT_CREATE_UUID"}, {13525 , "EVENT_FRS_NO_DNS_ATTRIBUTE"}, {13526 , "EVENT_FRS_NO_SID"}, {13527 , "NTFRSPRF_OPEN_RPC_BINDING_ERROR_SET"}, {13528 , "NTFRSPRF_OPEN_RPC_BINDING_ERROR_CONN"}, {13529 , "NTFRSPRF_OPEN_RPC_CALL_ERROR_SET"}, {13530 , "NTFRSPRF_OPEN_RPC_CALL_ERROR_CONN"}, {13531 , "NTFRSPRF_COLLECT_RPC_BINDING_ERROR_SET"}, {13532 , "NTFRSPRF_COLLECT_RPC_BINDING_ERROR_CONN"}, {13533 , "NTFRSPRF_COLLECT_RPC_CALL_ERROR_SET"}, {13534 , "NTFRSPRF_COLLECT_RPC_CALL_ERROR_CONN"}, {13535 , "NTFRSPRF_VIRTUALALLOC_ERROR_SET"}, {13536 , "NTFRSPRF_VIRTUALALLOC_ERROR_CONN"}, {13537 , "NTFRSPRF_REGISTRY_ERROR_SET"}, {13538 , "NTFRSPRF_REGISTRY_ERROR_CONN"}, {13539 , "EVENT_FRS_ROOT_NOT_VALID"}, {13540 , "EVENT_FRS_STAGE_NOT_VALID"}, {13541 , "EVENT_FRS_OVERLAPS_LOGGING"}, {13542 , "EVENT_FRS_OVERLAPS_WORKING"}, {13543 , "EVENT_FRS_OVERLAPS_STAGE"}, {13544 , "EVENT_FRS_OVERLAPS_ROOT"}, {13545 , "EVENT_FRS_OVERLAPS_OTHER_STAGE"}, {13546 , "EVENT_FRS_PREPARE_ROOT_FAILED"}, {13547 , "EVENT_FRS_BAD_REG_DATA"}, {13548 , "EVENT_FRS_JOIN_FAIL_TIME_SKEW"}, {13549 , "EVENT_FRS_RMTCO_TIME_SKEW"}, {13550 , "EVENT_FRS_CANT_OPEN_STAGE"}, {13551 , "EVENT_FRS_CANT_OPEN_PREINSTALL"}, {13552 , "EVENT_FRS_REPLICA_SET_CREATE_FAIL"}, {13553 , "EVENT_FRS_REPLICA_SET_CREATE_OK"}, {13554 , "EVENT_FRS_REPLICA_SET_CXTIONS"}, {13555 , "EVENT_FRS_IN_ERROR_STATE"}, {13556 , "EVENT_FRS_REPLICA_NO_ROOT_CHANGE"}, {13557 , "EVENT_FRS_DUPLICATE_IN_CXTION_SYSVOL"}, {13558 , "EVENT_FRS_DUPLICATE_IN_CXTION"}, {13559 , "EVENT_FRS_ROOT_HAS_MOVED"}, {13560 , "EVENT_FRS_ERROR_REPLICA_SET_DELETED"}, {13561 , "EVENT_FRS_REPLICA_IN_JRNL_WRAP_ERROR"}, {13562 , "EVENT_FRS_DS_POLL_ERROR_SUMMARY"}, {13563 , "EVENT_FRS_STAGE_HAS_CHANGED"}, {13564 , "EVENT_FRS_LOG_SPACE"}, {13565 , "EVENT_FRS_SYSVOL_NOT_READY_2"}, {13566 , "EVENT_FRS_SYSVOL_NOT_READY_PRIMARY_2"}, {13567 , "EVENT_FRS_FILE_UPDATES_SUPPRESSED"}, {13568 , "EVENT_FRS_REPLICA_IN_JRNL_WRAP_NO_AUTO_RESTORE"}, {13569 , "EVENT_FRS_FILES_SKIPPED_DURING_PRIMARY_LOAD"},
{0 , "Event tag not found"}
};
//
// The following was extracted from E:\nt\ds\ese98\src\ese\server\obj\i386\jetmsg.h
//
FRS_EL_ENTRY JetEvents[] = {
{(0x00000001L), "GENERAL_CATEGORY"}, {(0x00000002L), "BUFFER_MANAGER_CATEGORY"}, {(0x00000003L), "LOGGING_RECOVERY_CATEGORY"}, {(0x00000004L), "SPACE_MANAGER_CATEGORY"}, {(0x00000005L), "DATA_DEFINITION_CATEGORY"}, {(0x00000006L), "DATA_MANIPULATION_CATEGORY"}, {(0x00000007L), "PERFORMANCE_CATEGORY"}, {(0x00000008L), "REPAIR_CATEGORY"}, {(0x00000009L), "CONVERSION_CATEGORY"}, {(0x0000000AL), "ONLINE_DEFRAG_CATEGORY"}, {(0x0000000BL), "SYSTEM_PARAMETER_CATEGORY"}, {(0x0000000CL), "DATABASE_CORRUPTION_CATEGORY"}, {(0x0000000DL), "DATABASE_ZEROING_CATEGORY"}, {(0x0000000EL), "TRANSACTION_MANAGER_CATEGORY"}, {(0x0000000FL), "RFS2_CATEGORY"}, {(0x00000010L), "OS_SNAPSHOT_BACKUP"}, {(0x00000011L), "MAC_CATEGORY"}, {(0x00000064L), "START_ID"}, {(0x00000065L), "STOP_ID"}, {(0x00000066L), "START_INSTANCE_ID"}, {(0x00000067L), "STOP_INSTANCE_ID"}, {(0x00000068L), "STOP_INSTANCE_ID_WITH_ERROR"}, {(0x000000C8L), "START_FULL_BACKUP_ID"}, {(0x000000C9L), "START_INCREMENTAL_BACKUP_ID"}, {(0x000000CAL), "STOP_BACKUP_ID"}, {(0x000000CBL), "STOP_BACKUP_ERROR_ID"}, {(0x000000CCL), "START_RESTORE_ID"}, {(0x000000CDL), "STOP_RESTORE_ID"}, {(0x000000CEL), "DATABASE_MISS_FULL_BACKUP_ERROR_ID"}, {(0x000000CFL), "STOP_BACKUP_ERROR_ABORT_BY_CALLER"}, {(0x000000D2L), "START_FULL_BACKUP_INSTANCE_ID"}, {(0x000000D3L), "START_INCREMENTAL_BACKUP_INSTANCE_ID"}, {(0x000000D4L), "START_SNAPSHOT_BACKUP_INSTANCE_ID"}, {(0x000000D5L), "STOP_BACKUP_INSTANCE_ID"}, {(0x000000D6L), "STOP_BACKUP_ERROR_INSTANCE_ID"}, {(0x000000D7L), "STOP_BACKUP_ERROR_ABORT_BY_CALLER_INSTANCE_ID"}, {(0x000000D8L), "DB_LOCATION_CHANGE_DETECTED"}, {(0x000000D9L), "BACKUP_ERROR_FOR_ONE_DATABASE"}, {(0x000000DAL), "BACKUP_ERROR_READ_FILE"}, {(0x000000DBL), "BACKUP_ERROR_INFO_UPDATE"}, {(0x000000DCL), "BACKUP_FILE_START"}, {(0x000000DDL), "BACKUP_FILE_STOP_OK"}, {(0x000000DEL), "BACKUP_FILE_STOP_BEFORE_END"}, {(0x000000DFL), "BACKUP_LOG_FILES_START"}, {(0x000000E0L), "BACKUP_TRUNCATE_LOG_FILES"}, {(0x000000E1L), "BACKUP_NO_TRUNCATE_LOG_FILES"}, {(0x0000012CL), "START_REDO_ID"}, {(0x0000012DL), "STATUS_REDO_ID"}, {(0x0000012EL), "STOP_REDO_ID"}, {(0x0000012FL), "ERROR_ID"}, {(0x00000190L), "S_O_READ_PAGE_TIME_ERROR_ID"}, {(0x00000191L), "S_O_WRITE_PAGE_ISSUE_ERROR_ID"}, {(0x00000192L), "S_O_WRITE_PAGE_ERROR_ID"}, {(0x00000193L), "S_O_PATCH_FILE_WRITE_PAGE_ERROR_ID"}, {(0x00000194L), "S_READ_PAGE_TIME_ERROR_ID"}, {(0x00000195L), "PRE_READ_PAGE_TIME_ERROR_ID"}, {(0x00000196L), "A_DIRECT_READ_PAGE_CORRUPTTED_ERROR_ID"}, {(0x00000197L), "BFIO_TERM_ID"}, {(0x00000198L), "LOG_WRITE_ERROR_ID"}, {(0x00000199L), "LOG_HEADER_WRITE_ERROR_ID"}, {(0x0000019AL), "LOG_READ_ERROR_ID"}, {(0x0000019BL), "LOG_BAD_VERSION_ERROR_ID"}, {(0x0000019CL), "LOG_HEADER_READ_ERROR_ID"}, {(0x0000019DL), "NEW_LOG_ERROR_ID"}, {(0x0000019EL), "LOG_FLUSH_WRITE_0_ERROR_ID"}, {(0x0000019FL), "LOG_FLUSH_WRITE_1_ERROR_ID"}, {(0x000001A0L), "LOG_FLUSH_WRITE_2_ERROR_ID"}, {(0x000001A1L), "LOG_FLUSH_WRITE_3_ERROR_ID"}, {(0x000001A2L), "LOG_FLUSH_OPEN_NEW_FILE_ERROR_ID"}, {(0x000001A3L), "RESTORE_DATABASE_READ_PAGE_ERROR_ID"}, {(0x000001A4L), "RESTORE_DATABASE_READ_HEADER_WARNING_ID"}, {(0x000001A5L), "RESTORE_DATABASE_PARTIALLY_ERROR_ID"}, {(0x000001A6L), "RESTORE_DATABASE_MISSED_ERROR_ID"}, {(0x000001A7L), "BAD_PAGE"}, {(0x000001A8L), "DISK_FULL_ERROR_ID"}, {(0x000001A9L), "LOG_DATABASE_MISMATCH_ERROR_ID"}, {(0x000001AAL), "FILE_NOT_FOUND_ERROR_ID"}, {(0x000001ABL), "FILE_ACCESS_DENIED_ERROR_ID"}, {(0x000001ACL), "LOW_LOG_DISK_SPACE"}, {(0x000001ADL), "LOG_DISK_FULL"}, {(0x000001AEL), "DATABASE_PATCH_FILE_MISMATCH_ERROR_ID"}, {(0x000001AFL), "STARTING_RESTORE_LOG_TOO_HIGH_ERROR_ID"}, {(0x000001B0L), "ENDING_RESTORE_LOG_TOO_LOW_ERROR_ID"}, {(0x000001B1L), "RESTORE_LOG_FILE_HAS_BAD_SIGNATURE_ERROR_ID"}, {(0x000001B2L), "RESTORE_LOG_FILE_NOT_CONTIGUOUS_ERROR_ID"}, {(0x000001B3L), "RESTORE_LOG_FILE_MISSING_ERROR_ID"}, {(0x000001B4L), "EXISTING_LOG_FILE_HAS_BAD_SIGNATURE_ERROR_ID"}, {(0x000001B5L), "EXISTING_LOG_FILE_NOT_CONTIGUOUS_ERROR_ID"}, {(0x000001B6L), "BAD_BACKUP_DATABASE_SIZE"}, {(0x000001B7L), "SHADOW_PAGE_WRITE_FAIL_ID"}, {(0x000001B8L), "LOG_FILE_CORRUPTED_ID"}, {(0x000001B9L), "DB_FILE_SYS_ERROR_ID"}, {(0x000001BAL), "DB_IO_SIZE_ERROR_ID"}, {(0x000001BBL), "LOG_FILE_SYS_ERROR_ID"}, {(0x000001BCL), "LOG_IO_SIZE_ERROR_ID"}, {(0x000001BDL), "SPACE_MAX_DB_SIZE_REACHED_ID"}, {(0x000001BEL), "REDO_END_ABRUPTLY_ERROR_ID"}, {(0x000001BFL), "BAD_PAGE_LINKS_ID"}, {(0x000001C0L), "CORRUPT_LONG_VALUE_ID"}, {(0x000001C1L), "CORRUPT_SLV_SPACE_ID"}, {(0x000001C2L), "CURRENT_LOG_FILE_MISSING_ERROR_ID"}, {(0x000001C3L), "LOG_FLUSH_WRITE_4_ERROR_ID"}, {(0x000001C4L), "REDO_MISSING_LOW_LOG_ERROR_ID"}, {(0x000001C5L), "REDO_MISSING_HIGH_LOG_ERROR_ID"}, {(0x000001C6L), "RESTORE_DATABASE_FAIL_ID"}, {(0x000001C7L), "LOG_OPEN_FILE_ERROR_ID"}, {(0x000001C8L), "PRIMARY_PAGE_READ_FAIL_ID"}, {(0x000001C9L), "EXISTING_LOG_FILE_HAS_BAD_SIGNATURE_ERROR_ID_2"}, {(0x000001CAL), "EXISTING_LOG_FILE_NOT_CONTIGUOUS_ERROR_ID_2"}, {(0x000001CBL), "BACKUP_LOG_FILE_MISSING_ERROR_ID"}, {(0x000001CCL), "LOG_TORN_WRITE_DURING_HARD_RESTORE_ID"}, {(0x000001CDL), "LOG_TORN_WRITE_DURING_HARD_RECOVERY_ID"}, {(0x000001CEL), "LOG_TORN_WRITE_DURING_SOFT_RECOVERY_ID"}, {(0x000001CFL), "LOG_CORRUPTION_DURING_HARD_RESTORE_ID"}, {(0x000001D0L), "LOG_CORRUPTION_DURING_HARD_RECOVERY_ID"}, {(0x000001D1L), "LOG_CORRUPTION_DURING_SOFT_RECOVERY_ID"}, {(0x000001D2L), "LOG_USING_SHADOW_SECTOR_ID"}, {(0x000001D3L), "INDEX_CORRUPTED_ID"}, {(0x000001D4L), "LOG_FLUSH_WRITE_5_ERROR_ID"}, {(0x000001D6L), "DB_PARTIALLY_ATTACHED_ID"}, {(0x000001D7L), "UNDO_FAILED_ID"}, {(0x000001D8L), "SHADOW_PAGE_READ_FAIL_ID"}, {(0x000001D9L), "DB_PARTIALLY_DETACHED_ID"}, {(0x000001DAL), "DATABASE_PAGE_CHECKSUM_MISMATCH_ID"}, {(0x000001DBL), "DATABASE_PAGE_NUMBER_MISMATCH_ID"}, {(0x000001DCL), "DATABASE_PAGE_DATA_MISSING_ID"}, {(0x000001DDL), "LOG_RANGE_CHECKSUM_MISMATCH_ID"}, {(0x000001DEL), "SLV_PAGE_CHECKSUM_MISMATCH_ID"}, {(0x000001DFL), "PATCH_PAGE_CHECKSUM_MISMATCH_ID"}, {(0x000001E0L), "PATCH_PAGE_NUMBER_MISMATCH_ID"}, {(0x000001E1L), "OSFILE_READ_ERROR_ID"}, {(0x000001E2L), "OSFILE_WRITE_ERROR_ID"}, {(0x000001E3L), "OSFS_CREATE_FOLDER_ERROR_ID"}, {(0x000001E4L), "OSFS_REMOVE_FOLDER_ERROR_ID"}, {(0x000001E5L), "OSFS_DELETE_FILE_ERROR_ID"}, {(0x000001E6L), "OSFS_MOVE_FILE_ERROR_ID"}, {(0x000001E7L), "OSFS_COPY_FILE_ERROR_ID"}, {(0x000001E8L), "OSFS_CREATE_FILE_ERROR_ID"}, {(0x000001E9L), "OSFS_OPEN_FILE_RO_ERROR_ID"}, {(0x000001EAL), "OSFS_OPEN_FILE_RW_ERROR_ID"}, {(0x000001EBL), "OSFS_SECTOR_SIZE_ERROR_ID"}, {(0x000001ECL), "LOG_DOWN_ID"}, {(0x000001EDL), "TRANSIENT_READ_ERROR_DETECTED_ID"}, {(0x000001EEL), "ATTACHED_DB_MISMATCH_END_OF_RECOVERY_ID"}, {(0x000001EFL), "ATTACHED_DB_MISMATCH_DURING_RECOVERY_ID"}, {(0x000001F0L), "REDO_HIGH_LOG_MISMATCH_ERROR_ID"}, {(0x000001F1L), "DATABASE_HEADER_ERROR_ID"}, {(0x000001F2L), "DELETE_LOG_FILE_TOO_NEW_ID"}, {(0x000001F3L), "DELETE_LAST_LOG_FILE_TOO_OLD_ID"}, {(0x000001F4L), "REPAIR_BAD_PAGE_ID"}, {(0x000001F5L), "REPAIR_PAGE_LINK_ID"}, {(0x000001F6L), "REPAIR_BAD_COLUMN_ID"}, {(0x000001F7L), "REPAIR_BAD_RECORD_ID"}, {(0x000001F8L), "REPAIR_BAD_TABLE"}, {(0x00000258L), "CONVERT_DUPLICATE_KEY"}, {(0x00000259L), "FUNCTION_NOT_FOUND_ERROR_ID"}, {(0x0000025AL), "MANY_LOST_COMPACTION_ID"}, {(0x0000025BL), "SPACE_LOST_ON_FREE_ID"}, {(0x0000025CL), "LANGUAGE_NOT_SUPPORTED_ID"}, {(0x0000025DL), "CONVERT_COLUMN_TO_TAGGED_ID"}, {(0x0000025EL), "CONVERT_COLUMN_TO_NONTAGGED_ID"}, {(0x0000025FL), "CONVERT_COLUMN_BINARY_TO_LONGBINARY_ID"}, {(0x00000260L), "CONVERT_COLUMN_TEXT_TO_LONGTEXT_ID"}, {(0x00000261L), "START_INDEX_CLEANUP_KNOWN_VERSION_ID"}, {(0x00000262L), "START_INDEX_CLEANUP_UNKNOWN_VERSION_ID"}, {(0x00000263L), "DO_SECONDARY_INDEX_CLEANUP_ID"}, {(0x00000264L), "STOP_INDEX_CLEANUP_ID"}, {(0x00000265L), "PRIMARY_INDEX_CORRUPT_ERROR_ID"}, {(0x00000266L), "SECONDARY_INDEX_CORRUPT_ERROR_ID"}, {(0x00000267L), "START_FORMAT_UPGRADE_ID"}, {(0x00000268L), "STOP_FORMAT_UPGRADE_ID"}, {(0x00000269L), "CONVERT_INCOMPLETE_ERROR_ID"}, {(0x0000026AL), "BUILD_SPACE_CACHE_ID"}, {(0x0000026BL), "ATTACH_TO_BACKUP_SET_DATABASE_ERROR_ID"}, {(0x0000026CL), "RECORD_FORMAT_CONVERSION_FAILED_ID"}, {(0x0000026DL), "OUT_OF_OBJID"}, {(0x0000026EL), "ALMOST_OUT_OF_OBJID"}, {(0x0000026FL), "VERSION_STORE_REACHED_MAXIMUM_ID"}, {(0x00000270L), "VERSION_STORE_OUT_OF_MEMORY_ID"}, {(0x00000271L), "INVALID_LCMAPFLAGS_ID"}, {(0x000002BCL), "OLD_BEGIN_FULL_PASS_ID"}, {(0x000002BDL), "OLD_COMPLETE_FULL_PASS_ID"}, {(0x000002BEL), "OLD_RESUME_PASS_ID"}, {(0x000002BFL), "OLD_COMPLETE_RESUMED_PASS_ID"}, {(0x000002C0L), "OLD_INTERRUPTED_PASS_ID"}, {(0x000002C1L), "OLD_ERROR_ID"}, {(0x000002C2L), "DATABASE_ZEROING_STARTED_ID"}, {(0x000002C3L), "DATABASE_ZEROING_STOPPED_ID"}, {(0x000002C4L), "OLDSLV_BEGIN_FULL_PASS_ID"}, {(0x000002C5L), "OLDSLV_COMPLETE_FULL_PASS_ID"}, {(0x000002C6L), "OLDSLV_SHRANK_DATABASE_ID"}, {(0x000002C7L), "OLDSLV_ERROR_ID"}, {(0x000002C8L), "DATABASE_SLV_ZEROING_STARTED_ID"}, {(0x000002C9L), "DATABASE_SLV_ZEROING_STOPPED_ID"}, {(0x000002CAL), "OLDSLV_STOP_ID"}, {(0x00000320L), "SYS_PARAM_CACHEMIN_CSESS_ERROR_ID"}, {(0x00000321L), "SYS_PARAM_CACHEMAX_CACHEMIN_ERROR_ID"}, {(0x00000322L), "SYS_PARAM_CACHEMAX_STOPFLUSH_ERROR_ID"}, {(0x00000323L), "SYS_PARAM_STOPFLUSH_STARTFLUSH_ERROR_ID"}, {(0x00000324L), "SYS_PARAM_LOGBUFFER_FILE_ERROR_ID"}, {(0x00000325L), "SYS_PARAM_MAXPAGES_PREFER_ID"}, {(0x00000326L), "SYS_PARAM_VERPREFERREDPAGE_ID"}, {(0x00000327L), "SYS_PARAM_CFCB_PREFER_ID"}, {(0x00000328L), "SYS_PARAM_VERPREFERREDPAGETOOBIG_ID"}, {(0x00000384L), "LOG_COMMIT0_FAIL_ID"}, {(0x00000385L), "INTERNAL_TRACE_ID"}, {(0x00000386L), "SESSION_SHARING_VIOLATION_ID"}, {(0x00000387L), "SESSION_WRITE_CONFLICT_ID"}, {(0x000007D1L), "OS_SNAPSHOT_FREEZE_START_ID"}, {(0x000007D2L), "OS_SNAPSHOT_FREEZE_START_ERROR_ID"}, {(0x000007D3L), "OS_SNAPSHOT_FREEZE_STOP_ID"}, {(0x000007D4L), "OS_SNAPSHOT_TIME_OUT_ID"}, {(0x000003E8L), "RFS2_INIT_ID"}, {(0x000003E9L), "RFS2_PERMITTED_ID"}, {(0x000003EAL), "RFS2_DENIED_ID"}, {(0x000003EBL), "RFS2_JET_CALL_ID"}, {(0x000003ECL), "RFS2_JET_ERROR_ID"}, {(0x000007D0L), "OS_SNAPSHOT_TRACE_ID"},
{0 , "Event tag not found"}
};
//
// Status values are 32 bit values layed out as follows:
//
// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
// +---+-+-------------------------+-------------------------------+
// |Sev|C| Facility | Code |
// +---+-+-------------------------+-------------------------------+
//
// where
//
// Sev - is the severity code
//
// 00 - Success
// 01 - Informational
// 10 - Warning
// 11 - Error
//
// C - is the Customer code flag
//
// Facility - is the facility code
//
// Code - is the facility's status code
//
//
// Below is from drivers\nlsmsg\ntiologc.mc
//
// FacilityNames=(System=0x0
// RpcRuntime=0x2:FACILITY_RPC_RUNTIME
// RpcStubs=0x3:FACILITY_RPC_STUBS
// Io=0x4:FACILITY_IO_ERROR_CODE
// )
FRS_EL_ENTRY SystemIoEvents[] = { {0x0001, "IO_ERR_RETRY_SUCCEEDED"}, {0x0002, "IO_ERR_INSUFFICIENT_RESOURCES"}, {0x0003, "IO_ERR_CONFIGURATION_ERROR"}, {0x0004, "IO_ERR_DRIVER_ERROR"}, {0x0005, "IO_ERR_PARITY"}, {0x0006, "IO_ERR_SEEK_ERROR"}, {0x0007, "IO_ERR_BAD_BLOCK"}, {0x0008, "IO_ERR_OVERRUN_ERROR"}, {0x0009, "IO_ERR_TIMEOUT"}, {0x000a, "IO_ERR_SEQUENCE"}, {0x000b, "IO_ERR_CONTROLLER_ERROR"}, {0x000c, "IO_ERR_INTERNAL_ERROR"}, {0x000d, "IO_ERR_INCORRECT_IRQL"}, {0x000e, "IO_ERR_INVALID_IOBASE"}, {0x000f, "IO_ERR_NOT_READY"}, {0x0010, "IO_ERR_INVALID_REQUEST"}, {0x0011, "IO_ERR_VERSION"}, {0x0012, "IO_ERR_LAYERED_FAILURE"}, {0x0013, "IO_ERR_RESET"}, {0x0014, "IO_ERR_PROTOCOL"}, {0x0015, "IO_ERR_MEMORY_CONFLICT_DETECTED"}, {0x0016, "IO_ERR_PORT_CONFLICT_DETECTED"}, {0x0017, "IO_ERR_DMA_CONFLICT_DETECTED"}, {0x0018, "IO_ERR_IRQ_CONFLICT_DETECTED"}, {0x0019, "IO_ERR_BAD_FIRMWARE"}, {0x001a, "IO_WRN_BAD_FIRMWARE"}, {0x001b, "IO_ERR_DMA_RESOURCE_CONFLICT"}, {0x001c, "IO_ERR_INTERRUPT_RESOURCE_CONFLICT"}, {0x001d, "IO_ERR_MEMORY_RESOURCE_CONFLICT"}, {0x001e, "IO_ERR_PORT_RESOURCE_CONFLICT"}, {0x001f, "IO_BAD_BLOCK_WITH_NAME"}, {0x0020, "IO_WRITE_CACHE_ENABLED"}, {0x0021, "IO_RECOVERED_VIA_ECC"}, {0x0022, "IO_WRITE_CACHE_DISABLED"}, {0x0024, "IO_FILE_QUOTA_THRESHOLD"}, {0x0025, "IO_FILE_QUOTA_LIMIT"}, {0x0026, "IO_FILE_QUOTA_STARTED"}, {0x0027, "IO_FILE_QUOTA_SUCCEEDED"}, {0x0028, "IO_FILE_QUOTA_FAILED"}, {0x0029, "IO_FILE_SYSTEM_CORRUPT"}, {0x002a, "IO_FILE_QUOTA_CORRUPT"}, {0x002b, "IO_SYSTEM_SLEEP_FAILED"}, {0x002c, "IO_DUMP_POINTER_FAILURE"}, {0x002d, "IO_DUMP_DRIVER_LOAD_FAILURE"}, {0x002e, "IO_DUMP_INITIALIZATION_FAILURE"}, {0x002f, "IO_DUMP_DUMPFILE_CONFLICT"}, {0x0030, "IO_DUMP_DIRECT_CONFIG_FAILED"}, {0x0031, "IO_DUMP_PAGE_CONFIG_FAILED"}, {0x0032, "IO_LOST_DELAYED_WRITE"}, {0x0033, "IO_WARNING_PAGING_FAILURE"}, {0x0034, "IO_WRN_FAILURE_PREDICTED"}, {0x0035, "IO_WARNING_INTERRUPT_STILL_PENDING"}, {0x0036, "IO_DRIVER_CANCEL_TIMEOUT"}, {0x0037, "IO_FILE_SYSTEM_CORRUPT_WITH_NAME"}, {0x0038, "IO_WARNING_ALLOCATION_FAILED"}, {0x0039, "IO_WARNING_LOG_FLUSH_FAILED"}, {0 , "Event tag not found"}
};
// The following came from \base\subsys\sm\sfc\dll\msg.mc
FRS_EL_ENTRY WindowsFileProtEvents[] = { {0xfa00, "MSG_DLL_CHANGE"}, {0xfa01, "MSG_DLL_CHANGE2"}, {0xfa02, "MSG_DLL_CHANGE3"}, {0xfa03, "MSG_DLL_CHANGE_NOVERSION"}, {0xfa04, "MSG_RESTORE_FAILURE"}, {0xfa05, "MSG_COPY_CANCEL"}, {0xfa06, "MSG_COPY_CANCEL_NOUI"}, {0xfa07, "MSG_RESTORE_FAILURE_MAX_RETRIES"}, {0xfa08, "MSG_DLL_NOVALIDATION_TERMINATION"}, {0xfa10, "MSG_SCAN_STARTED"}, {0xfa11, "MSG_SCAN_COMPLETED"}, {0xfa12, "MSG_SCAN_CANCELLED"}, {0xfa13, "MSG_SCAN_FOUND_BAD_FILE_NOVERSION"}, {0xfa14, "MSG_SCAN_FOUND_BAD_FILE"}, {0xfa15, "MSG_CACHE_COPY_ERROR"}, {0xfa20, "MSG_DISABLE"}, {0xfa21, "MSG_INITIALIZATION_FAILED"}, {0xfa22, "MSG_DLLCACHE_INVALID"}, {0xfa23, "MSG_CATALOG_RESTORE_FAILURE"}, {0xfa24, "MSG_SXS_INITIALIZATION_FAILED"},
{0 , "Event tag not found"} };
// The following came from \drivers\vsm\vsmio\nt\dmiolog.mc
FRS_EL_ENTRY DMIOEvents[] = {
{0x0001 , "VXERR_SPURCLOSE"}, {0x0002 , "VXERR_DRLDETLOG"}, {0x0003 , "VXERR_DRLDET"}, {0x0004 , "VXERR_RDWR"}, {0x0005 , "VXERR_OBJDET"}, {0x0006 , "VXERR_MIRDET"}, {0x0007 , "VXERR_KLOGFULL"}, {0x0008 , "VXERR_KLOGUPDATE"}, {0x0009 , "VXERR_RAID5DET"}, {0x000a , "VXERR_RAID5OBJDET"}, {0x000b , "VXERR_RAID5DEGRADE"}, {0x000c , "VXERR_RAID5FAILED"}, {0x000d , "VXERR_RAID5LOG"}, {0x000e , "VXERR_R5LOGDET"}, {0x000f , "VXERR_ILOCKSTRAND"}, {0x0010 , "VXERR_ILOCKOVERLAP"}, {0x0011 , "VXERR_ILLEGALVMINOR"}, {0x0012 , "VXERR_IOERROR"}, {0x0013 , "VXERR_IOERROR2"}, {0x0014 , "VXERR_OPENDISK"}, {0x0015 , "VXERR_CLOSEDISK"}, {0x0016 , "VXERR_CORRECTRDERR"}, {0x0017 , "VXLOG_BBREASSIGN"}, {0x0018 , "VXLOG_SBBREASSIGN"}, {0x0019 , "VXLOG_FBBREASSIGN"}, {0x001a , "VXLOG_FOUNDBB"}, {0x001b , "VXLOG_RAIDINITCORR"}, {0x001c , "VXLOG_RAIDINITFAIL"}, {0x001d , "VXLOG_DISK_READ_ERR"}, {0x001e , "VXLOG_DISK_WRITE_ERR"}, {0x001f , "VXLOG_DISKRM_WRITE_ERR"}, {0x0020 , "VXLOG_DISKRM_READ_ERR"}, {0x0021 , "VXLOG_DISK_DISABLED"}, {0x0022 , "VXLOG_DISK_REONLINE"}, {0x0023 , "VXERR_READ_ERROR"}, {0x0024 , "VXERR_READ_ERROR2"}, {0x0025 , "VXERR_WRITE_ERROR"}, {0x0026 , "VXERR_WRITE_ERROR2"},
{0 , "Event tag not found"}
};
//
// The below comes from net\netevent\netevent.mc
//
//#define STATUS_SEVERITY_WARNING 0x2
//#define STATUS_SEVERITY_SUCCESS 0x0
//#define STATUS_SEVERITY_INFORMATIONAL 0x1
//#define STATUS_SEVERITY_ERROR 0x3
//
FRS_EL_ENTRY NetEvents[] = { {0xC00007D0L, "EVENT_SRV_SERVICE_FAILED"}, {0xC00007D1L, "EVENT_SRV_RESOURCE_SHORTAGE"}, {0xC00007D2L, "EVENT_SRV_CANT_CREATE_DEVICE"}, {0xC00007D3L, "EVENT_SRV_CANT_CREATE_PROCESS"}, {0xC00007D4L, "EVENT_SRV_CANT_CREATE_THREAD"}, {0xC00007D5L, "EVENT_SRV_UNEXPECTED_DISC"}, {0xC00007D6L, "EVENT_SRV_INVALID_REQUEST"}, {0xC00007D7L, "EVENT_SRV_CANT_OPEN_NPFS"}, {0x800007D9L, "EVENT_SRV_CANT_GROW_TABLE"}, {0xC00007DAL, "EVENT_SRV_CANT_START_SCAVENGER"}, {0xC00007DBL, "EVENT_SRV_IRP_STACK_SIZE"}, {0x800007DCL, "EVENT_SRV_NETWORK_ERROR"}, {0x800007DDL, "EVENT_SRV_DISK_FULL"}, {0xC00007E0L, "EVENT_SRV_NO_VIRTUAL_MEMORY"}, {0xC00007E1L, "EVENT_SRV_NONPAGED_POOL_LIMIT"}, {0xC00007E2L, "EVENT_SRV_PAGED_POOL_LIMIT"}, {0xC00007E3L, "EVENT_SRV_NO_NONPAGED_POOL"}, {0xC00007E4L, "EVENT_SRV_NO_PAGED_POOL"}, {0x800007E5L, "EVENT_SRV_NO_WORK_ITEM"}, {0x800007E6L, "EVENT_SRV_NO_FREE_CONNECTIONS"}, {0x800007E7L, "EVENT_SRV_NO_FREE_RAW_WORK_ITEM"}, {0x800007E8L, "EVENT_SRV_NO_BLOCKING_IO"}, {0x800007E9L, "EVENT_SRV_DOS_ATTACK_DETECTED"}, {0x800007EAL, "EVENT_SRV_TOO_MANY_DOS"}, {0x800007EBL, "EVENT_SRV_OUT_OF_WORK_ITEM_DOS"}, {0xC00009C5L, "EVENT_SRV_KEY_NOT_FOUND"}, {0xC00009C6L, "EVENT_SRV_KEY_NOT_CREATED"}, {0xC00009C7L, "EVENT_SRV_NO_TRANSPORTS_BOUND"}, {0x800009C8L, "EVENT_SRV_CANT_BIND_TO_TRANSPORT"}, {0xC00009C9L, "EVENT_SRV_CANT_BIND_DUP_NAME"}, {0x800009CAL, "EVENT_SRV_INVALID_REGISTRY_VALUE"}, {0x800009CBL, "EVENT_SRV_INVALID_SD"}, {0x800009CCL, "EVENT_SRV_CANT_LOAD_DRIVER"}, {0x800009CDL, "EVENT_SRV_CANT_UNLOAD_DRIVER"}, {0x800009CEL, "EVENT_SRV_CANT_MAP_ERROR"}, {0x800009CFL, "EVENT_SRV_CANT_RECREATE_SHARE"}, {0x800009D0L, "EVENT_SRV_CANT_CHANGE_DOMAIN_NAME"}, {0x80000BB9L, "EVENT_RDR_RESOURCE_SHORTAGE"}, {0x80000BBAL, "EVENT_RDR_CANT_CREATE_DEVICE"}, {0x80000BBBL, "EVENT_RDR_CANT_CREATE_THREAD"}, {0x80000BBCL, "EVENT_RDR_CANT_SET_THREAD"}, {0x80000BBDL, "EVENT_RDR_INVALID_REPLY"}, {0x80000BBEL, "EVENT_RDR_INVALID_SMB"}, {0x80000BBFL, "EVENT_RDR_INVALID_LOCK_REPLY"}, {0x80000BC1L, "EVENT_RDR_FAILED_UNLOCK"}, {0x80000BC3L, "EVENT_RDR_CLOSE_BEHIND"}, {0x80000BC4L, "EVENT_RDR_UNEXPECTED_ERROR"}, {0x80000BC5L, "EVENT_RDR_TIMEOUT"}, {0x80000BC6L, "EVENT_RDR_INVALID_OPLOCK"}, {0x80000BC7L, "EVENT_RDR_CONNECTION_REFERENCE"}, {0x80000BC8L, "EVENT_RDR_SERVER_REFERENCE"}, {0x80000BC9L, "EVENT_RDR_SMB_REFERENCE"}, {0x80000BCAL, "EVENT_RDR_ENCRYPT"}, {0x80000BCBL, "EVENT_RDR_CONNECTION"}, {0x80000BCDL, "EVENT_RDR_MAXCMDS"}, {0x80000BCEL, "EVENT_RDR_OPLOCK_SMB"}, {0x80000BCFL, "EVENT_RDR_DISPOSITION"}, {0x80000BD0L, "EVENT_RDR_CONTEXTS"}, {0x80000BD1L, "EVENT_RDR_WRITE_BEHIND_FLUSH_FAILED"}, {0x80000BD2L, "EVENT_RDR_AT_THREAD_MAX"}, {0x80000BD3L, "EVENT_RDR_CANT_READ_REGISTRY"}, {0x80000BD4L, "EVENT_RDR_TIMEZONE_BIAS_TOO_LARGE"}, {0x80000BD5L, "EVENT_RDR_PRIMARY_TRANSPORT_CONNECT_FAILED"}, {0x80000BD6L, "EVENT_RDR_DELAYED_SET_ATTRIBUTES_FAILED"}, {0x80000BD7L, "EVENT_RDR_DELETEONCLOSE_FAILED"}, {0x80000BD8L, "EVENT_RDR_CANT_BIND_TRANSPORT"}, {0x80000BD9L, "EVENT_RDR_CANT_REGISTER_ADDRESS"}, {0x80000BDAL, "EVENT_RDR_CANT_GET_SECURITY_CONTEXT"}, {0x80000BDBL, "EVENT_RDR_CANT_BUILD_SMB_HEADER"}, {0x80000BDCL, "EVENT_RDR_SECURITY_SIGNATURE_MISMATCH"}, {0x40000C1CL, "EVENT_TCPIP6_STARTED"}, {0xC0000FA0L, "EVENT_STREAMS_STRLOG"}, {0x80000FA1L, "EVENT_STREAMS_ALLOCB_FAILURE"}, {0x80000FA2L, "EVENT_STREAMS_ALLOCB_FAILURE_CNT"}, {0x80000FA3L, "EVENT_STREAMS_ESBALLOC_FAILURE"}, {0x80000FA4L, "EVENT_STREAMS_ESBALLOC_FAILURE_CNT"}, {0xC0001004L, "EVENT_TCPIP_CREATE_DEVICE_FAILED"}, {0xC0001005L, "EVENT_TCPIP_NO_RESOURCES_FOR_INIT"}, {0xC0001059L, "EVENT_TCPIP_TOO_MANY_NETS"}, {0xC000105AL, "EVENT_TCPIP_NO_MASK"}, {0xC000105BL, "EVENT_TCPIP_INVALID_ADDRESS"}, {0xC000105CL, "EVENT_TCPIP_INVALID_MASK"}, {0xC000105DL, "EVENT_TCPIP_NO_ADAPTER_RESOURCES"}, {0x8000105EL, "EVENT_TCPIP_DHCP_INIT_FAILED"}, {0xC000105FL, "EVENT_TCPIP_ADAPTER_REG_FAILURE"}, {0x80001060L, "EVENT_TCPIP_INVALID_DEFAULT_GATEWAY"}, {0xC0001061L, "EVENT_TCPIP_NO_ADDRESS_LIST"}, {0xC0001062L, "EVENT_TCPIP_NO_MASK_LIST"}, {0xC0001063L, "EVENT_TCPIP_NO_BINDINGS"}, {0xC0001064L, "EVENT_TCPIP_IP_INIT_FAILED"}, {0x80001065L, "EVENT_TCPIP_TOO_MANY_GATEWAYS"}, {0xC0001066L, "EVENT_TCPIP_ADDRESS_CONFLICT1"}, {0xC0001067L, "EVENT_TCPIP_ADDRESS_CONFLICT2"}, {0xC0001068L, "EVENT_TCPIP_NTE_CONTEXT_LIST_FAILURE"}, {0x40001069L, "EVENT_TCPIP_MEDIA_CONNECT"}, {0x4000106AL, "EVENT_TCPIP_MEDIA_DISCONNECT"}, {0xC0001081L, "EVENT_TCPIP_TCP_INIT_FAILED"}, {0x800010A9L, "EVENT_TCPIP_UDP_LIMIT_REACHED"}, {0xC00010B9L, "EVENT_IPSEC_NO_RESOURCES_FOR_INIT"}, {0xC00010BAL, "EVENT_IPSEC_CREATE_DEVICE_FAILED"}, {0xC00010BBL, "EVENT_IPSEC_BAD_SPI_RECEIVED"}, {0xC00010BCL, "EVENT_IPSEC_UNEXPECTED_CLEARTEXT"}, {0xC00010BDL, "EVENT_IPSEC_AUTH_FAILURE"}, {0xC00010BEL, "EVENT_IPSEC_BAD_PACKET_SYNTAX"}, {0xC00010BFL, "EVENT_IPSEC_BAD_PROTOCOL_RECEIVED"}, {0xC00010C0L, "EVENT_IPSEC_GENERIC_FAILURE"}, {0xC00010C1L, "EVENT_IPSEC_NEG_FAILURE"}, {0x400010C2L, "EVENT_IPSEC_DROP_PACKET_INBOUND"}, {0x400010C3L, "EVENT_IPSEC_DROP_PACKET_OUTBOUND"}, {0xC00010CCL, "EVENT_NBT_CREATE_DRIVER"}, {0xC00010CDL, "EVENT_NBT_OPEN_REG_PARAMS"}, {0x800010CEL, "EVENT_NBT_NO_BACKUP_WINS"}, {0x800010CFL, "EVENT_NBT_NO_WINS"}, {0x800010D0L, "EVENT_NBT_BAD_BACKUP_WINS_ADDR"}, {0x800010D1L, "EVENT_NBT_BAD_PRIMARY_WINS_ADDR"}, {0xC00010D2L, "EVENT_NBT_NAME_SERVER_ADDRS"}, {0xC00010D3L, "EVENT_NBT_CREATE_ADDRESS"}, {0xC00010D4L, "EVENT_NBT_CREATE_CONNECTION"}, {0xC00010D5L, "EVENT_NBT_NON_OS_INIT"}, {0xC00010D6L, "EVENT_NBT_TIMERS"}, {0xC00010D7L, "EVENT_NBT_CREATE_DEVICE"}, {0x800010D8L, "EVENT_NBT_NO_DEVICES"}, {0xC00010D9L, "EVENT_NBT_OPEN_REG_LINKAGE"}, {0xC00010DAL, "EVENT_NBT_READ_BIND"}, {0xC00010DBL, "EVENT_NBT_READ_EXPORT"}, {0x800010DCL, "EVENT_NBT_OPEN_REG_NAMESERVER"}, {0x800010DDL, "EVENT_SCOPE_LABEL_TOO_LONG"}, {0x800010DEL, "EVENT_SCOPE_TOO_LONG"}, {0xC00010DFL, "EVENT_NBT_DUPLICATE_NAME"}, {0xC00010E0L, "EVENT_NBT_NAME_RELEASE"}, {0xC00010E1L, "EVENT_NBT_DUPLICATE_NAME_ERROR"}, {0xC00010E2L, "EVENT_NBT_NO_RESOURCES"}, {0xC0001388L, "EVENT_NDIS_RESOURCE_CONFLICT"}, {0xC0001389L, "EVENT_NDIS_OUT_OF_RESOURCE"}, {0xC000138AL, "EVENT_NDIS_HARDWARE_FAILURE"}, {0xC000138BL, "EVENT_NDIS_ADAPTER_NOT_FOUND"}, {0xC000138CL, "EVENT_NDIS_INTERRUPT_CONNECT"}, {0xC000138DL, "EVENT_NDIS_DRIVER_FAILURE"}, {0xC000138EL, "EVENT_NDIS_BAD_VERSION"}, {0x8000138FL, "EVENT_NDIS_TIMEOUT"}, {0xC0001390L, "EVENT_NDIS_NETWORK_ADDRESS"}, {0xC0001391L, "EVENT_NDIS_UNSUPPORTED_CONFIGURATION"}, {0xC0001392L, "EVENT_NDIS_INVALID_VALUE_FROM_ADAPTER"}, {0xC0001393L, "EVENT_NDIS_MISSING_CONFIGURATION_PARAMETER"}, {0xC0001394L, "EVENT_NDIS_BAD_IO_BASE_ADDRESS"}, {0x40001395L, "EVENT_NDIS_RECEIVE_SPACE_SMALL"}, {0x80001396L, "EVENT_NDIS_ADAPTER_DISABLED"}, {0x80001397L, "EVENT_NDIS_IO_PORT_CONFLICT"}, {0x80001398L, "EVENT_NDIS_PORT_OR_DMA_CONFLICT"}, {0x80001399L, "EVENT_NDIS_MEMORY_CONFLICT"}, {0x8000139AL, "EVENT_NDIS_INTERRUPT_CONFLICT"}, {0x8000139BL, "EVENT_NDIS_DMA_CONFLICT"}, {0xC000139CL, "EVENT_NDIS_INVALID_DOWNLOAD_FILE_ERROR"}, {0x8000139DL, "EVENT_NDIS_MAXRECEIVES_ERROR"}, {0x8000139EL, "EVENT_NDIS_MAXTRANSMITS_ERROR"}, {0x8000139FL, "EVENT_NDIS_MAXFRAMESIZE_ERROR"}, {0x800013A0L, "EVENT_NDIS_MAXINTERNALBUFS_ERROR"}, {0x800013A1L, "EVENT_NDIS_MAXMULTICAST_ERROR"}, {0x800013A2L, "EVENT_NDIS_PRODUCTID_ERROR"}, {0x800013A3L, "EVENT_NDIS_LOBE_FAILUE_ERROR"}, {0x800013A4L, "EVENT_NDIS_SIGNAL_LOSS_ERROR"}, {0x800013A5L, "EVENT_NDIS_REMOVE_RECEIVED_ERROR"}, {0x400013A6L, "EVENT_NDIS_TOKEN_RING_CORRECTION"}, {0xC00013A7L, "EVENT_NDIS_ADAPTER_CHECK_ERROR"}, {0x800013A8L, "EVENT_NDIS_RESET_FAILURE_ERROR"}, {0x800013A9L, "EVENT_NDIS_CABLE_DISCONNECTED_ERROR"}, {0x800013AAL, "EVENT_NDIS_RESET_FAILURE_CORRECTION"}, {0x80001770L, "EVENT_LOG_FULL"}, {0x80001771L, "EVENT_LogFileNotOpened"}, {0x80001772L, "EVENT_LogFileCorrupt"}, {0x80001773L, "EVENT_DefaultLogCorrupt"}, {0x80001774L, "EVENT_BadDriverPacket"}, {0x80001775L, "EVENT_EventlogStarted"}, {0x80001776L, "EVENT_EventlogStopped"}, {0x80001777L, "TITLE_EventlogMessageBox"}, {0x80001778L, "EVENT_EventlogAbnormalShutdown"}, {0x80001779L, "EVENT_EventLogProductInfo"}, {0xC000177AL, "EVENT_ServiceNoEventLog"}, {0xC000177BL, "EVENT_ComputerNameChange"}, {0xC000177CL, "EVENT_DNSDomainNameChange"}, {0xC00017D4L, "EVENT_UP_DRIVER_ON_MP"}, {0xC0001B58L, "EVENT_SERVICE_START_FAILED"}, {0xC0001B59L, "EVENT_SERVICE_START_FAILED_II"}, {0xC0001B5AL, "EVENT_SERVICE_START_FAILED_GROUP"}, {0xC0001B5BL, "EVENT_SERVICE_START_FAILED_NONE"}, {0xC0001B5DL, "EVENT_CALL_TO_FUNCTION_FAILED"}, {0xC0001B5EL, "EVENT_CALL_TO_FUNCTION_FAILED_II"}, {0xC0001B5FL, "EVENT_REVERTED_TO_LASTKNOWNGOOD"}, {0xC0001B60L, "EVENT_BAD_ACCOUNT_NAME"}, {0xC0001B61L, "EVENT_CONNECTION_TIMEOUT"}, {0xC0001B62L, "EVENT_READFILE_TIMEOUT"}, {0xC0001B63L, "EVENT_TRANSACT_TIMEOUT"}, {0xC0001B64L, "EVENT_TRANSACT_INVALID"}, {0xC0001B65L, "EVENT_FIRST_LOGON_FAILED"}, {0xC0001B66L, "EVENT_SECOND_LOGON_FAILED"}, {0xC0001B67L, "EVENT_INVALID_DRIVER_DEPENDENCY"}, {0xC0001B68L, "EVENT_BAD_SERVICE_STATE"}, {0xC0001B69L, "EVENT_CIRCULAR_DEPENDENCY_DEMAND"}, {0xC0001B6AL, "EVENT_CIRCULAR_DEPENDENCY_AUTO"}, {0xC0001B6BL, "EVENT_DEPEND_ON_LATER_SERVICE"}, {0xC0001B6CL, "EVENT_DEPEND_ON_LATER_GROUP"}, {0xC0001B6DL, "EVENT_SEVERE_SERVICE_FAILED"}, {0xC0001B6EL, "EVENT_SERVICE_START_HUNG"}, {0xC0001B6FL, "EVENT_SERVICE_EXIT_FAILED"}, {0xC0001B70L, "EVENT_SERVICE_EXIT_FAILED_SPECIFIC"}, {0xC0001B71L, "EVENT_SERVICE_START_AT_BOOT_FAILED"}, {0xC0001B72L, "EVENT_BOOT_SYSTEM_DRIVERS_FAILED"}, {0xC0001B73L, "EVENT_RUNNING_LASTKNOWNGOOD"}, {0xC0001B74L, "EVENT_TAKE_OWNERSHIP"}, {0xC0001B75L, "TITLE_SC_MESSAGE_BOX"}, {0xC0001B76L, "EVENT_SERVICE_NOT_INTERACTIVE"}, {0xC0001B77L, "EVENT_SERVICE_CRASH"}, {0xC0001B78L, "EVENT_SERVICE_RECOVERY_FAILED"}, {0xC0001B79L, "EVENT_SERVICE_SCESRV_FAILED"}, {0xC0001B7AL, "EVENT_SERVICE_CRASH_NO_ACTION"}, {0x40001B7BL, "EVENT_SERVICE_CONTROL_SUCCESS"}, {0x40001B7CL, "EVENT_SERVICE_STATUS_SUCCESS"}, {0xC0001B7DL, "EVENT_SERVICE_CONFIG_BACKOUT_FAILED"}, {0xC0001B7EL, "EVENT_FIRST_LOGON_FAILED_II"}, {0xC0001EDCL, "EVENT_COMMAND_NOT_INTERACTIVE"}, {0xC0001EDDL, "EVENT_COMMAND_START_FAILED"}, {0xC0001F43L, "EVENT_BOWSER_OTHER_MASTER_ON_NET"}, {0x80001F44L, "EVENT_BOWSER_PROMOTED_WHILE_ALREADY_MASTER"}, {0x80001F45L, "EVENT_BOWSER_NON_MASTER_MASTER_ANNOUNCE"}, {0x80001F46L, "EVENT_BOWSER_ILLEGAL_DATAGRAM"}, {0xC0001F47L, "EVENT_BROWSER_STATUS_BITS_UPDATE_FAILED"}, {0xC0001F48L, "EVENT_BROWSER_ROLE_CHANGE_FAILED"}, {0xC0001F49L, "EVENT_BROWSER_MASTER_PROMOTION_FAILED"}, {0xC0001F4AL, "EVENT_BOWSER_NAME_CONVERSION_FAILED"}, {0xC0001F4BL, "EVENT_BROWSER_OTHERDOMAIN_ADD_FAILED"}, {0x00001F4CL, "EVENT_BOWSER_ELECTION_RECEIVED"}, {0x40001F4DL, "EVENT_BOWSER_ELECTION_SENT_GETBLIST_FAILED"}, {0x40001F4EL, "EVENT_BOWSER_ELECTION_SENT_FIND_MASTER_FAILED"}, {0x40001F4FL, "EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STARTED"}, {0xC0001F50L, "EVENT_BOWSER_ILLEGAL_DATAGRAM_THRESHOLD"}, {0xC0001F51L, "EVENT_BROWSER_DEPENDANT_SERVICE_FAILED"}, {0xC0001F53L, "EVENT_BROWSER_MASTER_PROMOTION_FAILED_STOPPING"}, {0xC0001F54L, "EVENT_BROWSER_MASTER_PROMOTION_FAILED_NO_MASTER"}, {0x80001F55L, "EVENT_BROWSER_SERVER_LIST_FAILED"}, {0x80001F56L, "EVENT_BROWSER_DOMAIN_LIST_FAILED"}, {0x80001F57L, "EVENT_BROWSER_ILLEGAL_CONFIG"}, {0x40001F58L, "EVENT_BOWSER_OLD_BACKUP_FOUND"}, {0x00001F59L, "EVENT_BROWSER_SERVER_LIST_RETRIEVED"}, {0x00001F5AL, "EVENT_BROWSER_DOMAIN_LIST_RETRIEVED"}, {0x40001F5BL, "EVENT_BOWSER_PDC_LOST_ELECTION"}, {0x40001F5CL, "EVENT_BOWSER_NON_PDC_WON_ELECTION"}, {0x40001F5DL, "EVENT_BOWSER_CANT_READ_REGISTRY"}, {0x40001F5EL, "EVENT_BOWSER_MAILSLOT_DATAGRAM_THRESHOLD_EXCEEDED"}, {0x40001F5FL, "EVENT_BOWSER_GETBROWSERLIST_THRESHOLD_EXCEEDED"}, {0xC0001F60L, "EVENT_BROWSER_BACKUP_STOPPED"}, {0x40001F61L, "EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STOPPED"}, {0xC0001F62L, "EVENT_BROWSER_GETBLIST_RECEIVED_NOT_MASTER"}, {0x40001F63L, "EVENT_BROWSER_ELECTION_SENT_ROLE_CHANGED"}, {0xC0001F64L, "EVENT_BROWSER_NOT_STARTED_IPX_CONFIG_MISMATCH"}, {0xC0002134L, "NWSAP_EVENT_KEY_NOT_FOUND"}, {0xC0002135L, "NWSAP_EVENT_WSASTARTUP_FAILED"}, {0xC0002136L, "NWSAP_EVENT_SOCKET_FAILED"}, {0xC0002137L, "NWSAP_EVENT_SETOPTBCAST_FAILED"}, {0xC0002138L, "NWSAP_EVENT_BIND_FAILED"}, {0xC0002139L, "NWSAP_EVENT_GETSOCKNAME_FAILED"}, {0xC000213AL, "NWSAP_EVENT_OPTEXTENDEDADDR_FAILED"}, {0xC000213BL, "NWSAP_EVENT_OPTBCASTINADDR_FAILED"}, {0xC000213CL, "NWSAP_EVENT_CARDMALLOC_FAILED"}, {0xC000213DL, "NWSAP_EVENT_NOCARDS"}, {0xC000213EL, "NWSAP_EVENT_THREADEVENT_FAIL"}, {0xC000213FL, "NWSAP_EVENT_RECVSEM_FAIL"}, {0xC0002140L, "NWSAP_EVENT_SENDEVENT_FAIL"}, {0xC0002141L, "NWSAP_EVENT_STARTRECEIVE_ERROR"}, {0xC0002142L, "NWSAP_EVENT_STARTWORKER_ERROR"}, {0xC0002143L, "NWSAP_EVENT_TABLE_MALLOC_FAILED"}, {0xC0002144L, "NWSAP_EVENT_HASHTABLE_MALLOC_FAILED"}, {0xC0002145L, "NWSAP_EVENT_STARTLPCWORKER_ERROR"}, {0xC0002146L, "NWSAP_EVENT_CREATELPCPORT_ERROR"}, {0xC0002147L, "NWSAP_EVENT_CREATELPCEVENT_ERROR"}, {0xC0002148L, "NWSAP_EVENT_LPCLISTENMEMORY_ERROR"}, {0xC0002149L, "NWSAP_EVENT_LPCHANDLEMEMORY_ERROR"}, {0xC000214AL, "NWSAP_EVENT_BADWANFILTER_VALUE"}, {0xC000214BL, "NWSAP_EVENT_CARDLISTEVENT_FAIL"}, {0xC000214CL, "NWSAP_EVENT_SDMDEVENT_FAIL"}, {0x8000214DL, "NWSAP_EVENT_INVALID_FILTERNAME"}, {0xC000214EL, "NWSAP_EVENT_WANSEM_FAIL"}, {0xC000214FL, "NWSAP_EVENT_WANSOCKET_FAILED"}, {0xC0002150L, "NWSAP_EVENT_WANBIND_FAILED"}, {0xC0002151L, "NWSAP_EVENT_STARTWANWORKER_ERROR"}, {0xC0002152L, "NWSAP_EVENT_STARTWANCHECK_ERROR"}, {0xC0002153L, "NWSAP_EVENT_OPTMAXADAPTERNUM_ERROR"}, {0xC0002154L, "NWSAP_EVENT_WANHANDLEMEMORY_ERROR"}, {0xC0002155L, "NWSAP_EVENT_WANEVENT_ERROR"}, {0x80002329L, "EVENT_TRANSPORT_RESOURCE_POOL"}, {0x8000232AL, "EVENT_TRANSPORT_RESOURCE_LIMIT"}, {0x8000232BL, "EVENT_TRANSPORT_RESOURCE_SPECIFIC"}, {0xC000232CL, "EVENT_TRANSPORT_REGISTER_FAILED"}, {0xC000232DL, "EVENT_TRANSPORT_BINDING_FAILED"}, {0xC000232EL, "EVENT_TRANSPORT_ADAPTER_NOT_FOUND"}, {0xC000232FL, "EVENT_TRANSPORT_SET_OID_FAILED"}, {0xC0002330L, "EVENT_TRANSPORT_QUERY_OID_FAILED"}, {0x40002331L, "EVENT_TRANSPORT_TRANSFER_DATA"}, {0x40002332L, "EVENT_TRANSPORT_TOO_MANY_LINKS"}, {0x40002333L, "EVENT_TRANSPORT_BAD_PROTOCOL"}, {0x4000251DL, "EVENT_IPX_NEW_DEFAULT_TYPE"}, {0x8000251EL, "EVENT_IPX_SAP_ANNOUNCE"}, {0x8000251FL, "EVENT_IPX_ILLEGAL_CONFIG"}, {0xC0002520L, "EVENT_IPX_INTERNAL_NET_INVALID"}, {0xC0002521L, "EVENT_IPX_NO_FRAME_TYPES"}, {0xC0002522L, "EVENT_IPX_CREATE_DEVICE"}, {0xC0002523L, "EVENT_IPX_NO_ADAPTERS"}, {0xC0002710L, "EVENT_RPCSS_CREATEPROCESS_FAILURE"}, {0xC0002711L, "EVENT_RPCSS_RUNAS_CREATEPROCESS_FAILURE"}, {0xC0002712L, "EVENT_RPCSS_LAUNCH_ACCESS_DENIED"}, {0xC0002713L, "EVENT_RPCSS_DEFAULT_LAUNCH_ACCESS_DENIED"}, {0xC0002714L, "EVENT_RPCSS_RUNAS_CANT_LOGIN"}, {0xC0002715L, "EVENT_RPCSS_START_SERVICE_FAILURE"}, {0xC0002716L, "EVENT_RPCSS_REMOTE_SIDE_ERROR"}, {0xC0002717L, "EVENT_RPCSS_ACTIVATION_ERROR"}, {0xC0002718L, "EVENT_RPCSS_REMOTE_SIDE_ERROR_WITH_FILE"}, {0xC0002719L, "EVENT_RPCSS_REMOTE_SIDE_UNAVAILABLE"}, {0xC000271AL, "EVENT_RPCSS_SERVER_START_TIMEOUT"}, {0xC000271BL, "EVENT_RPCSS_SERVER_NOT_RESPONDING"}, {0xC000271CL, "EVENT_DCOM_ASSERTION_FAILURE"}, {0xC000271DL, "EVENT_DCOM_INVALID_ENDPOINT_DATA"}, {0xC0002AF8L, "EVENT_DNS_CACHE_START_FAILURE_NO_DLL"}, {0xC0002AF9L, "EVENT_DNS_CACHE_START_FAILURE_NO_ENTRY"}, {0xC0002AFAL, "EVENT_DNS_CACHE_START_FAILURE_NO_CONTROL"}, {0xC0002AFBL, "EVENT_DNS_CACHE_START_FAILURE_NO_DONE_EVENT"}, {0xC0002AFCL, "EVENT_DNS_CACHE_START_FAILURE_NO_RPC"}, {0xC0002AFDL, "EVENT_DNS_CACHE_START_FAILURE_NO_SHUTDOWN_NOTIFY"}, {0xC0002AFEL, "EVENT_DNS_CACHE_START_FAILURE_NO_UPDATE"}, {0xC0002AFFL, "EVENT_DNS_CACHE_START_FAILURE_LOW_MEMORY"}, {0x80002B2AL, "EVENT_DNS_CACHE_NETWORK_PERF_WARNING"}, {0x80002B2BL, "EVENT_DNS_CACHE_UNABLE_TO_REACH_SERVER_WARNING"}, {0x80002B8EL, "EVENT_DNSAPI_REGISTRATION_FAILED_TIMEOUT"}, {0x80002B8FL, "EVENT_DNSAPI_REGISTRATION_FAILED_SERVERFAIL"}, {0x80002B90L, "EVENT_DNSAPI_REGISTRATION_FAILED_NOTSUPP"}, {0x80002B91L, "EVENT_DNSAPI_REGISTRATION_FAILED_REFUSED"}, {0x80002B92L, "EVENT_DNSAPI_REGISTRATION_FAILED_SECURITY"}, {0x80002B93L, "EVENT_DNSAPI_REGISTRATION_FAILED_OTHER"}, {0x80002B94L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_TIMEOUT"}, {0x80002B95L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_SERVERFAIL"}, {0x80002B96L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_NOTSUPP"}, {0x80002B97L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_REFUSED"}, {0x80002B98L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_SECURITY"}, {0x80002B99L, "EVENT_DNSAPI_PTR_REGISTRATION_FAILED_OTHER"}, {0x80002B9AL, "EVENT_DNSAPI_REGISTRATION_FAILED_TIMEOUT_PRIMARY_DN"}, {0x80002B9BL, "EVENT_DNSAPI_REGISTRATION_FAILED_SERVERFAIL_PRIMARY_DN"}, {0x80002B9CL, "EVENT_DNSAPI_REGISTRATION_FAILED_NOTSUPP_PRIMARY_DN"}, {0x80002B9DL, "EVENT_DNSAPI_REGISTRATION_FAILED_REFUSED_PRIMARY_DN"}, {0x80002B9EL, "EVENT_DNSAPI_REGISTRATION_FAILED_SECURITY_PRIMARY_DN"}, {0x80002B9FL, "EVENT_DNSAPI_REGISTRATION_FAILED_OTHER_PRIMARY_DN"}, {0x80002BACL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_TIMEOUT"}, {0x80002BADL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_SERVERFAIL"}, {0x80002BAEL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_NOTSUPP"}, {0x80002BAFL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_REFUSED"}, {0x80002BB0L, "EVENT_DNSAPI_DEREGISTRATION_FAILED_SECURITY"}, {0x80002BB1L, "EVENT_DNSAPI_DEREGISTRATION_FAILED_OTHER"}, {0x80002BB2L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_TIMEOUT"}, {0x80002BB3L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_SERVERFAIL"}, {0x80002BB4L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_NOTSUPP"}, {0x80002BB5L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_REFUSED"}, {0x80002BB6L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_SECURITY"}, {0x80002BB7L, "EVENT_DNSAPI_PTR_DEREGISTRATION_FAILED_OTHER"}, {0x80002BB8L, "EVENT_DNSAPI_DEREGISTRATION_FAILED_TIMEOUT_PRIMARY_DN"}, {0x80002BB9L, "EVENT_DNSAPI_DEREGISTRATION_FAILED_SERVERFAIL_PRIMARY_DN"}, {0x80002BBAL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_NOTSUPP_PRIMARY_DN"}, {0x80002BBBL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_REFUSED_PRIMARY_DN"}, {0x80002BBCL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_SECURITY_PRIMARY_DN"}, {0x80002BBDL, "EVENT_DNSAPI_DEREGISTRATION_FAILED_OTHER_PRIMARY_DN"}, {0x40002BC0L, "EVENT_DNSAPI_REGISTERED_ADAPTER"}, {0x40002BC1L, "EVENT_DNSAPI_REGISTERED_PTR"}, {0x40002BC2L, "EVENT_DNSAPI_REGISTERED_ADAPTER_PRIMARY_DN"}, {0xC0002EE0L, "EVENT_WMI_CANT_OPEN_DEVICE"}, {0x80002F44L, "EVENT_WMI_INVALID_MOF"}, {0x80002F45L, "EVENT_WMI_MOF_LOAD_FAILURE"}, {0x80002F46L, "EVENT_WMI_INVALID_REGINFO"}, {0x80002F47L, "EVENT_WMI_INVALID_REGPATH"}, {0x80002F48L, "EVENT_WMI_CANT_RESOLVE_INSTANCE"}, {0x80002F49L, "EVENT_WMI_CANT_GET_EVENT_DATA"}, {0xC00030D4L, "EVENT_TRK_INTERNAL_ERROR"}, {0x400030D5L, "EVENT_TRK_SERVICE_START_SUCCESS"}, {0xC00030D6L, "EVENT_TRK_SERVICE_START_FAILURE"}, {0xC00030D7L, "EVENT_TRK_SERVICE_CORRUPT_LOG"}, {0x800030D8L, "EVENT_TRK_SERVICE_VOL_QUOTA_EXCEEDED"}, {0x400030D9L, "EVENT_TRK_SERVICE_VOLUME_CREATE"}, {0x400030DAL, "EVENT_TRK_SERVICE_VOLUME_CLAIM"}, {0x400030DBL, "EVENT_TRK_SERVICE_DUPLICATE_VOLIDS"}, {0x800030DCL, "EVENT_TRK_SERVICE_MOVE_QUOTA_EXCEEDED"}, {0xC000332CL, "EVENT_ATMLANE_CFGREQ_FAIL_VERSNOSUPP"}, {0xC000332DL, "EVENT_ATMLANE_JOINREQ_FAIL_VERSNOSUPP"}, {0xC000332EL, "EVENT_ATMLANE_CFGREQ_FAIL_REQPARMINVAL"}, {0xC000332FL, "EVENT_ATMLANE_JOINREQ_FAIL_REQPARMINVAL"}, {0xC0003330L, "EVENT_ATMLANE_JOINREQ_FAIL_DUPLANDEST"}, {0xC0003331L, "EVENT_ATMLANE_JOINREQ_FAIL_DUPATMADDR"}, {0xC0003332L, "EVENT_ATMLANE_CFGREQ_FAIL_INSUFFRES"}, {0xC0003333L, "EVENT_ATMLANE_JOINREQ_FAIL_INSUFFRES"}, {0xC0003334L, "EVENT_ATMLANE_CFGREQ_FAIL_NOACCESS"}, {0xC0003335L, "EVENT_ATMLANE_JOINREQ_FAIL_NOACCESS"}, {0xC0003336L, "EVENT_ATMLANE_CFGREQ_FAIL_REQIDINVAL"}, {0xC0003337L, "EVENT_ATMLANE_JOINREQ_FAIL_REQIDINVAL"}, {0xC0003338L, "EVENT_ATMLANE_CFGREQ_FAIL_LANDESTINVAL"}, {0xC0003339L, "EVENT_ATMLANE_JOINREQ_FAIL_LANDESTINVAL"}, {0xC000333AL, "EVENT_ATMLANE_CFGREQ_FAIL_ATMADDRINVAL"}, {0xC000333BL, "EVENT_ATMLANE_JOINREQ_FAIL_ATMADDRINVAL"}, {0xC000333CL, "EVENT_ATMLANE_CFGREQ_FAIL_NOCONF"}, {0xC000333DL, "EVENT_ATMLANE_CFGREQ_FAIL_CONFERROR"}, {0xC000333EL, "EVENT_ATMLANE_CFGREQ_FAIL_INSUFFINFO"}, {0xC0003390L, "EVENT_ATMARPS_ADDRESS_ALREADY_EXISTS"}, {0xC00036B0L, "EVENT_PS_GPC_REGISTER_FAILED"}, {0xC00036B1L, "EVENT_PS_NO_RESOURCES_FOR_INIT"}, {0xC00036B2L, "EVENT_PS_REGISTER_PROTOCOL_FAILED"}, {0xC00036B3L, "EVENT_PS_REGISTER_MINIPORT_FAILED"}, {0x80003714L, "EVENT_PS_BAD_BESTEFFORT_LIMIT"}, {0xC0003715L, "EVENT_PS_QUERY_OID_GEN_MAXIMUM_FRAME_SIZE"}, {0xC0003716L, "EVENT_PS_QUERY_OID_GEN_MAXIMUM_TOTAL_SIZE"}, {0xC0003717L, "EVENT_PS_QUERY_OID_GEN_LINK_SPEED"}, {0xC0003718L, "EVENT_PS_BINDING_FAILED"}, {0xC0003719L, "EVENT_PS_MISSING_ADAPTER_REGISTRY_DATA"}, {0xC000371AL, "EVENT_PS_REGISTER_ADDRESS_FAMILY_FAILED"}, {0xC000371BL, "EVENT_PS_INIT_DEVICE_FAILED"}, {0xC000371CL, "EVENT_PS_WMI_INSTANCE_NAME_FAILED"}, {0x8000371DL, "EVENT_PS_WAN_LIMITED_BESTEFFORT"}, {0xC000371EL, "EVENT_PS_RESOURCE_POOL"}, {0x8000371FL, "EVENT_PS_ADMISSIONCONTROL_OVERFLOW"}, {0xC0003720L, "EVENT_PS_NETWORK_ADDRESS_FAIL"},
// DFS Events.
{14300 , "EXTRA_EXIT_POINT"}, {14301 , "MISSING_EXIT_POINT"}, {14302 , "MISSING_VOLUME"}, {14303 , "EXTRA_VOLUME"}, {14304 , "EXTRA_EXIT_POINT_DELETED"}, {14305 , "EXTRA_EXIT_POINT_NOT_DELETED"}, {14306 , "MISSING_EXIT_POINT_CREATED"}, {14307 , "MISSING_EXIT_POINT_NOT_CREATED"}, {14308 , "MISSING_VOLUME_CREATED"}, {14309 , "MISSING_VOLUME_NOT_CREATED"}, {14310 , "EXTRA_VOLUME_DELETED"}, {14311 , "EXTRA_VOLUME_NOT_DELETED"}, {14312 , "COULD_NOT_VERIFY_VOLUMES"}, {14313 , "KNOWLEDGE_INCONSISTENCY_DETECTED"}, {14314 , "PREFIX_MISMATCH"}, {14315 , "PREFIX_MISMATCH_FIXED"}, {14316 , "PREFIX_MISMATCH_NOT_FIXED"}, {14317 , "MACHINE_UNJOINED"}, {14318 , "DFS_REFERRAL_REQUEST"}, {14400 , "NOT_A_DFS_PATH"}, {14401 , "LM_REDIR_FAILURE"}, {14402 , "DFS_CONNECTION_FAILURE"}, {14403 , "DFS_REFERRAL_FAILURE"}, {14404 , "DFS_REFERRAL_SUCCESS"}, {14405 , "DFS_MAX_DNR_ATTEMPTS"}, {14406 , "DFS_SPECIAL_REFERRAL_FAILURE"}, {14407 , "DFS_OPEN_FAILURE"}, {14500 , "NET_DFS_ENUM"}, {14501 , "NET_DFS_ENUMEX"}, {14502 , "DFS_ERROR_CREATE_DIRECTORY_FAILURE"}, {14503 , "DFS_ERROR_CREATE_REPARSEPOINT_FAILURE"}, {14504 , "DFS_ERROR_UNSUPPORTED_FILESYSTEM"}, {14505 , "DFS_ERROR_OVERLAPPING_DIRECTORIES"}, {14506 , "DFS_ERROR_AD_WRITE_ERROR"}, {14507 , "DFS_ERROR_AD_READ_ERROR"}, {14508 , "DFS_ERROR_DIRECTORY_NOT_EMPTY"}, {14509 , "DFS_ERROR_TOO_MANY_ERRORS"}, {14510 , "DFS_ERROR_WINSOCKINIT_FAILED"}, {14511 , "DFS_ERROR_SECURITYINIT_FAILED"}, {14512 , "DFS_ERROR_THREADINIT_FAILED"}, {14513 , "DFS_ERROR_SITECACHEINIT_FAILED"}, {14514 , "DFS_ERROR_ROOTSYNCINIT_FAILED"}, {14515 , "DFS_ERROR_CREATEEVENT_FAILED"}, {14516 , "DFS_ERROR_COMPUTERINFO_FAILED"}, {14517 , "DFS_ERROR_CLUSTERINFO_FAILED"}, {14518 , "DFS_ERROR_DCINFO_FAILED"}, {14519 , "DFS_ERROR_PREFIXTABLE_FAILED"}, {14520 , "DFS_ERROR_HANDLENAMESPACE_FAILED"}, {14521 , "DFS_ERROR_REGISTERSTORE_FAILED"}, {14522 , "DFS_ERROR_REFLECTIONENGINE_FAILED"}, {14523 , "DFS_ERROR_SPECIALSHARES_FAILED"}, {14524 , "DFS_ERROR_SITESUPPOR_FAILED"}, {14525 , "DFS_ERROR_DSINITIALCONNECT_FAILED"}, {14526 , "DFS_ERROR_DSCONNECT_FAILED"}, {14527 , "DFS_ERROR_ROOT_TURNED_OFF"}, {14528 , "DFS_INFO_ROOT_TURNED_ON"}, {14529 , "DFS_INFO_DS_RECONNECTED"},
{0xC0003908L, "EVENT_BRIDGE_PROTOCOL_REGISTER_FAILED"}, {0xC0003909L, "EVENT_BRIDGE_MINIPROT_DEVNAME_MISSING"}, {0xC000390AL, "EVENT_BRIDGE_MINIPORT_REGISTER_FAILED"}, {0xC000390BL, "EVENT_BRIDGE_DEVICE_CREATION_FAILED"}, {0xC000390CL, "EVENT_BRIDGE_NO_BRIDGE_MAC_ADDR"}, {0xC000390DL, "EVENT_BRIDGE_MINIPORT_INIT_FAILED"}, {0xC000390EL, "EVENT_BRIDGE_ETHERNET_NOT_OFFERED"}, {0xC000390FL, "EVENT_BRIDGE_THREAD_CREATION_FAILED"}, {0xC0003910L, "EVENT_BRIDGE_THREAD_REF_FAILED"}, {0xC0003911L, "EVENT_BRIDGE_PACKET_POOL_CREATION_FAILED"}, {0xC0003912L, "EVENT_BRIDGE_BUFFER_POOL_CREATION_FAILED"}, {0xC0003913L, "EVENT_BRIDGE_INIT_MALLOC_FAILED"}, {0xC000396CL, "EVENT_BRIDGE_ADAPTER_LINK_SPEED_QUERY_FAILED"}, {0xC000396DL, "EVENT_BRIDGE_ADAPTER_MAC_ADDR_QUERY_FAILED"}, {0xC000396EL, "EVENT_BRIDGE_ADAPTER_FILTER_FAILED"}, {0xC000396FL, "EVENT_BRIDGE_ADAPTER_NAME_QUERY_FAILED"}, {0xC0003970L, "EVENT_BRIDGE_ADAPTER_BIND_FAILED"}, // Time service codes from \nt\ds\security\services\w32time\w32time\obj\i386\w32timemsg.h
{0xC25A0001L, "MSG_TIMEPROV_ERROR"}, {0x825A0002L, "MSG_TIMEPROV_WARNING"}, {0x425A0003L, "MSG_TIMEPROV_INFORMATIONAL"}, {0xC25A0004L, "MSG_TIMEPROV_FAILED_START"}, {0xC25A0005L, "MSG_TIMEPROV_FAILED_STOP"}, {0x825A0006L, "MSG_CONFIG_READ_FAILED_WARNING"}, {0x825A0007L, "MSG_TIMEPROV_FAILED_UPDATE"}, {0x825A0008L, "MSG_TIMEPROV_FAILED_POLLUPDATE"}, {0x825A0009L, "MSG_TIMEPROV_FAILED_TIMEJUMP"}, {0x825A000AL, "MSG_TIMEPROV_FAILED_GETSAMPLES"}, {0x825A000BL, "MSG_NOT_DOMAIN_MEMBER"}, {0x825A000CL, "MSG_DOMAIN_HIERARCHY_ROOT"}, {0x825A000DL, "MSG_NT4_DOMAIN"}, {0x825A000EL, "MSG_NO_DC_LOCATED"}, {0xC25A000FL, "MSG_NO_DC_LOCATED_UNEXPECTED_ERROR"}, {0x825A0010L, "MSG_MANUAL_PEER_LOOKUP_FAILED_UNEXPECTED"}, {0x825A0011L, "MSG_MANUAL_PEER_LOOKUP_FAILED_RETRYING"}, {0x825A0012L, "MSG_RID_LOOKUP_FAILED"}, {0xC25A0013L, "MSG_FILELOG_FAILED"}, {0xC25A0014L, "MSG_FILELOG_WRITE_FAILED"}, {0xC25A0015L, "MSG_NO_INPUT_PROVIDERS_STARTED"}, {0x825A0016L, "MSG_CLIENT_COMPUTE_SERVER_DIGEST_FAILED"}, {0x825A0017L, "MSG_SYMMETRIC_COMPUTE_SERVER_DIGEST_FAILED"}, {0x825A0018L, "MSG_DOMHIER_PEER_TIMEOUT"}, {0x825A0019L, "MSG_COMPUTE_CLIENT_DIGEST_FAILED"}, {0x825A001AL, "MSG_BAD_SIGNATURE"}, {0x825A001BL, "MSG_MISSING_SIGNATURE"}, {0xC25A001CL, "MSG_NO_NTP_PEERS"}, {0xC25A001DL, "MSG_NO_NTP_PEERS_BUT_PENDING"}, {0xC25A001EL, "MSG_CONFIG_READ_FAILED"}, {0x825A001FL, "MSG_TIME_ZONE_FIXED"}, {0xC25A0020L, "MSG_TIME_ZONE_FIX_FAILED"}, {0x825A0021L, "MSG_TIME_JUMPED"}, {0xC25A0022L, "MSG_TIME_CHANGE_TOO_BIG"}, {0x425A0023L, "MSG_TIME_SOURCE_CHOSEN"}, {0x825A0024L, "MSG_TIME_SOURCE_NONE"}, {0x425A0025L, "MSG_TIME_SOURCE_REACHABLE"}, {0x425A0026L, "MSG_TIME_SOURCE_UNREACHABLE"}, {0x825A0027L, "MSG_TCP_NOT_INSTALLED"}, {0x825A0028L, "MSG_TIMEPROV_STOPPED"}, {0xC25A0029L, "MSG_NO_INPUT_PROVIDERS_RUNNING"}, {0xC25A002AL, "MSG_NAMED_EVENT_ALREADY_OPEN"}, {0x825A002BL, "MSG_TIMEPROV_FAILED_NETTOPOCHANGE"}, {0xC25A002CL, "MSG_NTPCLIENT_ERROR_SHUTDOWN"}, {0xC25A002DL, "MSG_NTPSERVER_ERROR_SHUTDOWN"}, {0xC25A002EL, "MSG_ERROR_SHUTDOWN"}, {0xC25A002FL, "MSG_MANUAL_PEER_TIMEOUT"}, {0xC25A0030L, "MSG_MANUAL_PEER_LOOKUP_FAILED"}, {0xC25A0031L, "MSG_NO_DC_LOCATED_LAST_WARNING"}, {0xC25A0032L, "MSG_LOCALCLOCK_UNSET"}, {0xC25A005AL, "W32TIMEMSG_AUTHTYPE_NOAUTH"}, {0xC25A005BL, "W32TIMEMSG_AUTHTYPE_NTDIGEST"}, {0xC25A005CL, "W32TIMEMSG_UNREACHABLE_PEER"}, {0xC25A005EL, "W32TIMEMSG_ERROR_PACKETTEST1"}, {0xC25A005FL, "W32TIMEMSG_ERROR_PACKETTEST2"}, {0xC25A0060L, "W32TIMEMSG_ERROR_PACKETTEST3"}, {0xC25A0061L, "W32TIMEMSG_ERROR_PACKETTEST4"}, {0xC25A0062L, "W32TIMEMSG_ERROR_PACKETTEST5"}, {0xC25A0063L, "W32TIMEMSG_ERROR_PACKETTEST6"}, {0xC25A0064L, "W32TIMEMSG_ERROR_PACKETTEST7"}, {0xC25A0065L, "W32TIMEMSG_ERROR_PACKETTEST8"}, {0xC25A0066L, "W32TIMEMSG_SERVICE_DESCRIPTION"},
{0 , "Event tag not found"}
};
// The following printer event codes from
// printscan\print\spooler\inc\messages.mc
FRS_EL_ENTRY PrinterEvents[] = {
{0x0002 ,"MSG_PRINTER_CREATED"}, {0x0003 ,"MSG_PRINTER_DELETED"}, {0x0004 ,"MSG_PRINTER_DELETION_PENDING"}, {0x0006 ,"MSG_PRINTER_PAUSED"}, {0x0007 ,"MSG_PRINTER_UNPAUSED"}, {0x0008 ,"MSG_PRINTER_PURGED"}, {0x0009 ,"MSG_PRINTER_SET"}, {0x000a ,"MSG_DOCUMENT_PRINTED"}, {0x000b ,"MSG_DOCUMENT_PAUSED"}, {0x000c ,"MSG_DOCUMENT_RESUMED"}, {0x000d ,"MSG_DOCUMENT_DELETED"}, {0x000e ,"MSG_DOCUMENT_POSITION_CHANGED"}, {0x000f ,"MSG_FORM_ADDED"}, {0x0010 ,"MSG_FORM_DELETED"}, {0x0012 ,"MSG_DOCUMENT_TIMEOUT"}, {0x0013 ,"MSG_SHARE_FAILED"}, {0x0014 ,"MSG_DRIVER_ADDED"}, {0x0015 ,"MSG_DRIVER_DELETED"}, {0x0016 ,"MSG_DRIVER_FAILED_UPGRADE"}, {0x0017 ,"MSG_NO_DRIVER_FOUND_FOR_PRINTER"}, {0x0018 ,"MSG_NO_PORT_FOUND_FOR_PRINTER"}, {0x0019 ,"MSG_FILES_COPIED"}, {0x001A ,"MSG_CANT_PUBLISH_PROPERTY"}, {0x001B ,"MSG_CANT_GET_CONTAINER"}, {0x001C ,"MSG_CANT_WRITE_ACL"}, {0x001D ,"MSG_CANT_DELETE_PRINTQUEUE"}, {0x001E ,"MSG_CANT_CREATE_PRINTQUEUE"}, {0x001F ,"MSG_CANT_PUBLISH_MANDATORY_PROPERTIES"}, {0x0020 ,"MSG_CANT_GET_PRIMARY_DOMAIN_INFO"}, {0x0021 ,"MSG_CANT_GET_DNS_DOMAIN_NAME"}, {0x0022 ,"MSG_CANT_BIND"}, {0x0023 ,"MSG_CANT_CRACK"}, {0x0024 ,"MSG_PRINTER_PUBLISHED"}, {0x0025 ,"MSG_PRINTER_NOT_PUBLISHED"}, {0x0026 ,"MSG_PRINTER_UNPUBLISHED"}, {0x0027 ,"MSG_PRINTER_NOT_UNPUBLISHED"}, {0x0028 ,"MSG_PRINTER_UPDATED"}, {0x0029 ,"MSG_CANT_CRACK_GUID"}, {0x002A ,"MSG_MISSING_PRINTER_UNPUBLISHED"}, {0x002B ,"MSG_NO_DS"}, {0x002C ,"MSG_CANT_GET_DNS_SERVER_NAME"}, {0x002D ,"MSG_DOCUMENT_FAILED_GDIDRIVER_ERROR"}, {0x002E ,"MSG_PRUNING_NOUNC_PRINTER"}, {0x002F ,"MSG_PRUNING_ABSENT_PRINTER"}, {0x0030 ,"MSG_PRUNING_UNPUBLISHED_PRINTER"}, {0x0031 ,"MSG_PRUNING_DUPLICATE_PRINTER"}, {0x0032 ,"MSG_PRUNING_PRINTER"}, {0x0033 ,"MSG_CANT_PRUNE_PRINTER"}, {0x0034 ,"MSG_BAD_OEM_DRIVER"}, {0x0035 ,"MSG_BACKUP_SPOOLER_REGISTRY"}, {0x0036 ,"MSG_BAD_JOB"}, {0x0037 ,"MSG_KM_PRINTERS_BLOCKED"}, {0x0038 ,"MSG_DOCUMENT_PRIORITY_CHANGED"}, {0x0039 ,"MSG_DOCUMENT_FAILED_ACCESS_DENIED"}, {0x003A ,"MSG_INIT_FAILED"}, {0x003B ,"MSG_CANT_ADD_CLUSTER_ACE"}, {0x003C ,"MSG_CANT_ADD_UPDATE_CLUSTER_DRIVER"}, {0x003D ,"MSG_PRINT_ON_PROC_FAILED"}, {0x003E ,"MSG_DRIVER_MISMATCHED_WITH_SERVER"}, {0x0018 ,"MSG_PORT_INITIALIZATION_ERROR"},
{0 , "Event tag not found"}
};
// The following DHCP event codes from
// \\index1\w2krtm\private\net\sockets\tcpcmd\dhcpm\server\messages\dhcpmsg.mc
FRS_EL_ENTRY DHCPEvents[] = {
{1000, "EVENT_SERVER_UNKNOWN_OPTION"}, {1001, "EVENT_SERVER_FAILED_REGISTER_SC"}, {1002, "EVENT_SERVER_INIT_DATA_FAILED"}, {1003, "EVENT_SERVER_INIT_REGISTRY_FAILED"}, {1004, "EVENT_SERVER_INIT_DATABASE_FAILED"}, {1005, "EVENT_SERVER_INIT_WINSOCK_FAILED"}, {1006, "EVENT_SERVER_INIT_RPC_FAILED"}, {1007, "EVENT_SERVER_INIT_SOCK_FAILED"}, {1008, "EVENT_SERVER_SHUTDOWN"}, {1009, "EVENT_SERVER_CLIENT_CLEANUP"}, {1010, "EVENT_SERVER_DATABASE_CLEANUP"}, {1011, "EVENT_SERVER_LEASE_NACK"}, {1012, "EVENT_SERVER_LEASE_DECLINED"}, {1013, "EVENT_SERVER_LEASE_RELEASE"}, {1014, "EVENT_SERVER_JET_ERROR"}, {1015, "EVENT_SERVER_JET_WARNING"}, {1016, "EVENT_SERVER_DATABASE_BACKUP"}, {1017, "EVENT_SERVER_CONFIG_BACKUP"}, {1018, "EVENT_SERVER_DATABASE_RESTORE_FAILED"}, {1019, "EVENT_SERVER_CONFIG_RESTORE_FAILED"}, {1020, "EVENT_SERVER_LOW_ADDRESS_WARNING"}, {1021, "EVENT_SERVER_LOAD_JET_FAILED"}, {1022, "EVENT_SERVER_JET_CONV_REQUIRED"}, {1023, "EVENT_SERVER_JET_CONV_IN_PROGRESS"}, {1024, "EVENT_SERVER_INIT_AND_READY"}, {1025, "EVENT_SERVER_BOOT_FILE_TABLE"}, {1026, "EVENT_SERVER_BOOT_FILE_NAME"}, {1027, "EVENT_SERVER_AUDIT_LOG_APPEND_FAILED"}, {1028, "EVENT_SERVER_INIT_AUDIT_LOG_FAILED"}, {1029, "EVENT_SERVER_PING_FAILED"}, {1030, "EVENT_SERVER_MOVE_AUDIT_LOG_FAILED"}, {1031, "EVENT_SERVER_CALLOUT_UNHANDLED_EXCEPTION"}, {1032, "EVENT_SERVER_CALLOUT_LOAD_EXCEPTION"}, {1033, "EVENT_SERVER_CALLOUT_LOAD_SUCCESS"}, {1034, "EVENT_SERVER_CALLOUT_LOAD_FAILED"}, {1035, "EVENT_SERVER_READ_ONLY_GROUP_ERROR"}, {1036, "EVENT_SERVER_ADMIN_GROUP_ERROR"}, {1037, "EVENT_SERVER_CLEANUP_STARTED"}, {1038, "EVENT_SERVER_IPCLEANUP_FINISHED"}, {1039, "EVENT_SERVER_MCASTCLEANUP_FINISHED"}, {1040, "EVENT_SERVER_DATABASE_RESTORE_SUCCEEDED"}, {1041, "DHCP_ROGUE_EVENT_NO_NETWORK"}, {1042, "DHCP_ROGUE_EVENT_UNAUTHORIZED_INFO"}, {1043, "DHCP_ROGUE_EVENT_STARTED"}, {1044, "DHCP_ROGUE_EVENT_STARTED_DOMAIN"}, {1045, "DHCP_ROGUE_EVENT_STOPPED"}, {1046, "DHCP_ROGUE_EVENT_STOPPED_DOMAIN"}, {1047, "DHCP_ROGUE_EVENT_JUST_UPGRADED"}, {1048, "DHCP_ROGUE_EVENT_JUST_UPGRADED_DOMAIN"}, {1049, "DHCP_ROGUE_EVENT_CANT_FIND_DOMAIN"}, {1050, "DHCP_ROGUE_EVENT_NETWORK_FAILURE"}, {1051, "DHCP_ROGUE_EVENT_UNAUTHORIZED"}, {1052, "DHCP_ROGUE_EVENT_OTHER_SERVER"}, {1053, "DHCP_ROGUE_EVENT_SAM_OTHER_SERVER"}, {1054, "DHCP_ROGUE_EVENT_SHUTDOWN"}, {1055, "DHCP_EVENT_DNS_REGPARAMS_FAILURE"}, {1056, "DHCP_EVENT_NO_DNSCREDENTIALS_ON_DC"}, {1057, "EVENT_SERVER_DATABASE_CONVERSION"}, {1058, "EVENT_SERVER_INIT_CONFIG_FAILED"}, {1059, "EVENT_SERVER_COULDNT_SEE_DS"}, {1060, "EVENT_SERVER_AUDITLOG_PATH_NOT_ACCESSIBLE"}, {1061, "EVENT_SERVER_BACKUP_PATH_NOT_ACCESSIBLE"}, {1062, "EVENT_SERVER_DB_PATH_NOT_ACCESSIBLE"}, {1063, "EVENT_SERVER_SCOPE_FULL"},
{0 , "Event tag not found"} };
// The following SceCli event codes from
// \\index1\sdnt\ds\security\services\scerpc\uevents.mc
FRS_EL_ENTRY SecPolicyEngine[] = {
{1000, "SCEEVENT_ERROR_BACKUP_SECURITY"}, {1001, "SCEPOL_ERROR_PROCESS_GPO"}, {1002, "SCEEVENT_ERROR_CREATE_GPO"}, {1003, "SCEEVENT_ERROR_QUEUE_RETRY_TIMEOUT"}, {1004, "SCEEVENT_ERROR_POLICY_QUEUE"}, {1005, "SCEEVENT_ERROR_JET_DATABASE"}, {1006, "SCEEVENT_ERROR_POLICY_PDCVERIFY"}, {1007, "SCEEVENT_ERROR_POLICY_PDCTIMEOUT"}, {1200, "SCEEVENT_WARNING_BACKUP_SECURITY"}, {1201, "SCEEVENT_WARNING_REGISTER"}, {1202, "SCEPOL_WARNING_PROCESS_GPO"}, {1203, "SCEEVENT_WARNING_MACHINE_ROLE"}, {1204, "SCEEVENT_WARNING_PROMOTE_SECURITY"}, {1205, "SCEEVENT_WARNING_LOW_DISK_SPACE"}, {1500, "SCEEVENT_INFO_BACKUP_SECURITY"}, {1700, "SCEEVENT_INFO_REPLICA"}, {1701, "SCEEVENT_INFO_REGISTER"}, {1702, "SCEPOL_INFO_IGNORE_DOMAINPOLICY"}, {1703, "SCEPOL_INFO_GPO_NOCHANGE"}, {1704, "SCEPOL_INFO_GPO_COMPLETED"}, {1705, "SCEPOL_INFO_PROCESS_GPO"}, {1706, "SCEEVENT_ERROR_CONVERT_PARAMETER"}, {1707, "SCEEVENT_ERROR_CONVERT_BAD_ENV_VAR"}, {1708, "SCEEVENT_INFO_ERROR_CONVERT_DRIVE"}, {1709, "SCEEVENT_INFO_SUCCESS_CONVERT_DRIVE"}, {1710, "SCEEVENT_WARNING_BACKUP_SECURITY_ROOT_SDDL"},
{0 , "Event tag not found"} };
// The following time service codes from
// \\index1\w2krtm\private\ntrk\source\timeserv\timeserv.h
FRS_EL_ENTRY TimeservEvents[] = { {0x40000000L, "MSG_TIMESET_SMALL"}, {0x40000001L, "MSG_TIMESOURCE"}, {0x40000002L, "MSG_CHANGE"}, {0x40000003L, "MSG_BC_FLYING"}, {0x40000004L, "MSG_TOO_OFTEN"}, {0x40000005L, "MSG_LEAP"}, {0x40000006L, "MSG_TIMESET_LARGE"}, {0x40000007L, "MSG_TOO_MUCH_SKEW"}, {0x80000008L, "MSG_QUAL_A"}, {0x80000009L, "MSG_NC_NOTSET"}, {0x8000000AL, "MSG_INET_FAILED"}, {0x8000000BL, "MSG_NTPTROUBLE"}, {0x8000000CL, "MSG_NTPBAD"}, {0x8000000DL, "MSG_GPSBAD"}, {0x8000000EL, "MSG_TOOBIG"}, {0x8000000FL, "MSG_DST"}, {0x80000010L, "MSG_COMM_PORT"}, {0x80000011L, "MSG_MODEM_TIMEOUT"}, {0x80000012L, "MSG_LINE_NOISE"}, {0x80000013L, "MSG_GC_TIMEOUTOK"}, {0x80000014L, "MSG_GC_NOTSET"}, {0x80000015L, "MSG_GC_NOTENTHS"}, {0x80000016L, "MSG_PRIMARY_FAILED"}, {0x80000017L, "MSG_SECONDARY_FAILED"}, {0x80000018L, "MSG_TOD_FAILED"}, {0x80000019L, "MSG_LONG_TIME"}, {0x8000001AL, "MSG_NO_DELAY"}, {0x8000001BL, "MSG_BC_NOTSET"}, {0x8000001CL, "MSG_DELAY_FAIL"}, {0x8000001DL, "MSG_FIFO"}, {0x8000001EL, "MSG_HEALTH"}, {0x8000001FL, "MSG_TOOEARLY"}, {0xC0000020L, "MSG_EVENT_KEY"}, {0xC0000021L, "MSG_EVENT_MSG"}, {0xC0000022L, "MSG_EVENT_TYPES"}, {0xC0000023L, "MSG_SCM_FAILED"}, {0xC0000024L, "MSG_CS_FAILED"}, {0xC0000025L, "MSG_OPT_FAILED"}, {0xC0000026L, "MSG_ATPE_FAILED"}, {0xC0000027L, "MSG_ATPD_FAILED"}, {0xC0000028L, "MSG_GCS_FAILED"}, {0xC0000029L, "MSG_SCS_FAILED"}, {0xC000002AL, "MSG_GCT_FAILED"}, {0xC000002BL, "MSG_SCT_FAILED"}, {0xC000002CL, "MSG_DEV_TIMEOUT"}, {0xC000002DL, "MSG_SLT_FAILED"}, {0xC000002EL, "MSG_SST_FAILED"}, {0xC000002FL, "MSG_CLOSE_FAILED"}, {0xC0000030L, "MSG_SSS_FAILED"}, {0xC0000031L, "MSG_BC_DRIVER"}, {0xC0000032L, "MSG_WNOE_FAILED"}, {0xC0000033L, "MSG_SOCKET_FAILED"}, {0xC0000034L, "MSG_NTP_NAME"}, {0x40000040L, "MSG_NTP_RFC868"},
{0 , "Event tag not found"} };
// \\index1\w2krtm\private\security\kerb.prx\server\kdcevent.h
FRS_EL_ENTRY KDCEvents[] = { {0x00000001L, "CATEGORY_KDC"}, {0x00000002L, "CATEGORY_MAX_CATEGORY"}, {0x80000003L, "KDCEVENT_UNKNOWN_PRINCIPAL"}, {0x80000004L, "KDCEVENT_FAILED_DOMAIN_CREDS"}, {0xC0000005L, "KDCEVENT_POLICY_UPDATE_FAILED"}, {0xC0000006L, "KDCEVENT_DOMAIN_LIST_UPDATE_FAILED"}, {0xC0000007L, "KDCEVENT_SAM_CALL_FAILED"}, {0xC0000008L, "KDCEVENT_NO_KEY_TYPE"}, {0x00000009L, "KDCEVENT_KRBTGT_PASSWORD_CHANGED"}, {0xC000000AL, "KDCEVENT_KRBTGT_PASSWORD_CHANGE_FAILED"}, {0xC000000BL, "KDCEVENT_NAME_NOT_UNIQUE"},
{0 , "Event tag not found"} };
// \nt\ds\ds\src\sam\server\sampmsgs.mc
FRS_EL_ENTRY SAMEvents[] = { {0x3000L, "SAMMSG_COMMIT_FAILED"}, {0x3001L, "SAMMSG_REFRESH_FAILED"}, {0x3002L, "SAMMSG_UPDATE_FAILED"}, {0x3003L, "SAMMSG_RPC_INIT_FAILED"}, {0x3004L, "SAMMSG_DUPLICATE_ACCOUNT_NAME"}, {0x3005L, "SAMMSG_DUPLICATE_SID"}, {0x3006L, "SAMMSG_LOCKOUT_NOT_UPDATED"}, {0x3007L, "SAMMSG_DATABASE_FILE_NOT_DELETED"}, {0x3008L, "SAMMSG_DATABASE_DIR_NOT_DELETED"}, {0x3009L, "SAMMSG_PROMOTED_TO_PDC"}, {0x300AL, "SAMMSG_DC_NEEDS_TO_BE_COMPUTER"}, {0x300BL, "SAMMSG_SITE_INFO_UPDATE_FAILED"}, {0x300CL, "SAMMSG_SITE_INFO_UPDATE_SUCCEEDED_ON"}, {0x300DL, "SAMMSG_SITE_INFO_UPDATE_SUCCEEDED_OFF"}, {0x300EL, "SAMMSG_CREDENTIAL_UPDATE_PKG_FAILED"}, {0x4000L, "SAMMSG_DUPLICATE_ACCOUNT"}, {0x4001L, "SAMMSG_USER_NOT_UPGRADED"}, {0x4002L, "SAMMSG_UNKNOWN_USER_NOT_UPGRADED"}, {0x4003L, "SAMMSG_ALIAS_NOT_UPGRADED"}, {0x4004L, "SAMMSG_UNKNOWN_ALIAS_NOT_UPGRADED"}, {0x4005L, "SAMMSG_GROUP_NOT_UPGRADED"}, {0x4006L, "SAMMSG_UNKNOWN_GROUP_NOT_UPGRADED"}, {0x4007L, "SAMMSG_ERROR_ALIAS_MEMBER"}, {0x4008L, "SAMMSG_ERROR_ALIAS_MEMBER_UNKNOWN"}, {0x4009L, "SAMMSG_ERROR_GROUP_MEMBER"}, {0x400aL, "SAMMSG_ERROR_GROUP_MEMBER_UNKNOWN"}, {0x400bL, "SAMMSG_FATAL_UPGRADE_ERROR"}, {0x400cL, "SAMMSG_KRBTGT_RENAMED"}, {0x400dL, "SAMMSG_BLANK_ADMIN_PASSWORD"}, {0x400eL, "SAMMSG_ERROR_UPGRADE_USERPARMS"}, {0x400fL, "SAMMSG_ERROR_SET_USERPARMS"}, {0x4010L, "SAMMSG_ACCEPTABLE_ERROR_UPGRADE_USER"}, {0x4011L, "SAMMSG_MEMBERSHIP_SETUP_ERROR_NO_GROUP"}, {0x4012L, "SAMMSG_MEMBERSHIP_SETUP_ERROR"}, {0x4013L, "SAMMSG_USER_SETUP_ERROR"}, {0x4014L, "SAMMSG_EA_TO_ADMIN_FAILED"}, {0x4015L, "SAMMSG_MACHINE_ACCOUNT_MISSING"}, {0x4016L, "SAMMSG_WELL_KNOWN_ACCOUNT_RECREATED"}, {0x4017L, "SAMMSG_WELL_KNOWN_GROUP_RECREATED"}, {0x4018L, "SAMMSG_CHANGE_TO_NATIVE_MODE"}, {0x4100L, "SAMMSG_RID_MANAGER_INITIALIZATION"}, {0x4101L, "SAMMSG_RID_POOL_UPDATE_FAILED"}, {0x4102L, "SAMMSG_GET_NEXT_RID_ERROR"}, {0x4103L, "SAMMSG_NO_RIDS_ASSIGNED"}, {0x4104L, "SAMMSG_MAX_DOMAIN_RID"}, {0x4105L, "SAMMSG_MAX_DC_RID"}, {0x4106L, "SAMMSG_INVALID_RID"}, {0x4107L, "SAMMSG_REQUESTING_NEW_RID_POOL"}, {0x4108L, "SAMMSG_RID_REQUEST_STATUS_SUCCESS"}, {0x4109L, "SAMMSG_RID_MANAGER_CREATION"}, {0x410AL, "SAMMSG_RID_INIT_FAILURE"}, {0x410BL, "SAMMSG_RID_REQUEST_STATUS_FAILURE"}, {0x4200L, "SAMMSG_AUDIT_ENABLED_LOCAL_GROUP_TO_ENABLED_UNIVERSAL_GROUP"}, {0x4201L, "SAMMSG_AUDIT_ENABLED_LOCAL_GROUP_TO_DISABLED_LOCAL_GROUP"}, {0x4202L, "SAMMSG_AUDIT_ENABLED_LOCAL_GROUP_TO_DISABLED_UNIVERSAL_GROUP"}, {0x4203L, "SAMMSG_AUDIT_ENABLED_GLOBAL_GROUP_TO_ENABLED_UNIVERSAL_GROUP"}, {0x4204L, "SAMMSG_AUDIT_ENABLED_GLOBAL_GROUP_TO_DISABLED_GLOBAL_GROUP"}, {0x4205L, "SAMMSG_AUDIT_ENABLED_GLOBAL_GROUP_TO_DISABLED_UNIVERSAL_GROUP"}, {0x4206L, "SAMMSG_AUDIT_ENABLED_UNIVERSAL_GROUP_TO_ENABLED_LOCAL_GROUP"}, {0x4207L, "SAMMSG_AUDIT_ENABLED_UNIVERSAL_GROUP_TO_ENABLED_GLOBAL_GROUP"}, {0x4208L, "SAMMSG_AUDIT_ENABLED_UNIVERSAL_GROUP_TO_DISABLED_LOCAL_GROUP"}, {0x4209L, "SAMMSG_AUDIT_ENABLED_UNIVERSAL_GROUP_TO_DISABLED_GLOBAL_GROUP"}, {0x420AL, "SAMMSG_AUDIT_ENABLED_UNIVERSAL_GROUP_TO_DISABLED_UNIVERSAL_GROUP"}, {0x420BL, "SAMMSG_AUDIT_DISABLED_LOCAL_GROUP_TO_ENABLED_LOCAL_GROUP"}, {0x420CL, "SAMMSG_AUDIT_DISABLED_LOCAL_GROUP_TO_ENABLED_UNIVERSAL_GROUP"}, {0x420DL, "SAMMSG_AUDIT_DISABLED_LOCAL_GROUP_TO_DISABLED_UNIVERSAL_GROUP"}, {0x420EL, "SAMMSG_AUDIT_DISABLED_GLOBAL_GROUP_TO_ENABLED_GLOBAL_GROUP"}, {0x420FL, "SAMMSG_AUDIT_DISABLED_GLOBAL_GROUP_TO_ENABLED_UNIVERSAL_GROUP"}, {0x4210L, "SAMMSG_AUDIT_DISABLED_GLOBAL_GROUP_TO_DISABLED_UNIVERSAL_GROUP"}, {0x4211L, "SAMMSG_AUDIT_DISABLED_UNIVERSAL_GROUP_TO_ENABLED_LOCAL_GROUP"}, {0x4212L, "SAMMSG_AUDIT_DISABLED_UNIVERSAL_GROUP_TO_ENABLED_GLOBAL_GROUP"}, {0x4213L, "SAMMSG_AUDIT_DISABLED_UNIVERSAL_GROUP_TO_ENABLED_UNIVERSAL_GROUP"}, {0x4214L, "SAMMSG_AUDIT_DISABLED_UNIVERSAL_GROUP_TO_DISABLED_LOCAL_GROUP"}, {0x4215L, "SAMMSG_AUDIT_DISABLED_UNIVERSAL_GROUP_TO_DISABLED_GLOBAL_GROUP"}, {0x4216L, "SAMMSG_AUDIT_MEMBER_ACCOUNT_NAME_NOT_AVAILABLE"},
{0 , "Event tag not found"} };
// The following come from \\index1\sdnt\public\sdk\inc\lmerrlog.h
#define ERRLOG_BASE 3100 /* NELOG errors start here */
#define ERRLOG2_BASE 5700 /* New NT NELOG errors start here */
FRS_EL_ENTRY NetlogonEvents[] = {
{(ERRLOG_BASE + 0), "NELOG_Internal_Error"}, {(ERRLOG_BASE + 1), "NELOG_Resource_Shortage"}, {(ERRLOG_BASE + 2), "NELOG_Unable_To_Lock_Segment"}, {(ERRLOG_BASE + 3), "NELOG_Unable_To_Unlock_Segment"}, {(ERRLOG_BASE + 4), "NELOG_Uninstall_Service"}, {(ERRLOG_BASE + 5), "NELOG_Init_Exec_Fail"}, {(ERRLOG_BASE + 6), "NELOG_Ncb_Error"}, {(ERRLOG_BASE + 7), "NELOG_Net_Not_Started"}, {(ERRLOG_BASE + 8), "NELOG_Ioctl_Error"}, {(ERRLOG_BASE + 9), "NELOG_System_Semaphore"}, {(ERRLOG_BASE + 10), "NELOG_Init_OpenCreate_Err"}, {(ERRLOG_BASE + 11), "NELOG_NetBios"}, {(ERRLOG_BASE + 12), "NELOG_SMB_Illegal"}, {(ERRLOG_BASE + 13), "NELOG_Service_Fail"}, {(ERRLOG_BASE + 14), "NELOG_Entries_Lost"}, {(ERRLOG_BASE + 20), "NELOG_Init_Seg_Overflow"}, {(ERRLOG_BASE + 21), "NELOG_Srv_No_Mem_Grow"}, {(ERRLOG_BASE + 22), "NELOG_Access_File_Bad"}, {(ERRLOG_BASE + 23), "NELOG_Srvnet_Not_Started"}, {(ERRLOG_BASE + 24), "NELOG_Init_Chardev_Err"}, {(ERRLOG_BASE + 25), "NELOG_Remote_API"}, {(ERRLOG_BASE + 26), "NELOG_Ncb_TooManyErr"}, {(ERRLOG_BASE + 27), "NELOG_Mailslot_err"}, {(ERRLOG_BASE + 28), "NELOG_ReleaseMem_Alert"}, {(ERRLOG_BASE + 29), "NELOG_AT_cannot_write"}, {(ERRLOG_BASE + 30), "NELOG_Cant_Make_Msg_File"}, {(ERRLOG_BASE + 31), "NELOG_Exec_Netservr_NoMem"}, {(ERRLOG_BASE + 32), "NELOG_Server_Lock_Failure"}, {(ERRLOG_BASE + 40), "NELOG_Msg_Shutdown"}, {(ERRLOG_BASE + 41), "NELOG_Msg_Sem_Shutdown"}, {(ERRLOG_BASE + 50), "NELOG_Msg_Log_Err"}, {(ERRLOG_BASE + 51), "NELOG_VIO_POPUP_ERR"}, {(ERRLOG_BASE + 52), "NELOG_Msg_Unexpected_SMB_Type"}, {(ERRLOG_BASE + 60), "NELOG_Wksta_Infoseg"}, {(ERRLOG_BASE + 61), "NELOG_Wksta_Compname"}, {(ERRLOG_BASE + 62), "NELOG_Wksta_BiosThreadFailure"}, {(ERRLOG_BASE + 63), "NELOG_Wksta_IniSeg"}, {(ERRLOG_BASE + 64), "NELOG_Wksta_HostTab_Full"}, {(ERRLOG_BASE + 65), "NELOG_Wksta_Bad_Mailslot_SMB"}, {(ERRLOG_BASE + 66), "NELOG_Wksta_UASInit"}, {(ERRLOG_BASE + 67), "NELOG_Wksta_SSIRelogon"}, {(ERRLOG_BASE + 70), "NELOG_Build_Name"}, {(ERRLOG_BASE + 71), "NELOG_Name_Expansion"}, {(ERRLOG_BASE + 72), "NELOG_Message_Send"}, {(ERRLOG_BASE + 73), "NELOG_Mail_Slt_Err"}, {(ERRLOG_BASE + 74), "NELOG_AT_cannot_read"}, {(ERRLOG_BASE + 75), "NELOG_AT_sched_err"}, {(ERRLOG_BASE + 76), "NELOG_AT_schedule_file_created"}, {(ERRLOG_BASE + 77), "NELOG_Srvnet_NB_Open"}, {(ERRLOG_BASE + 78), "NELOG_AT_Exec_Err"}, {(ERRLOG_BASE + 80), "NELOG_Lazy_Write_Err"}, {(ERRLOG_BASE + 81), "NELOG_HotFix"}, {(ERRLOG_BASE + 82), "NELOG_HardErr_From_Server"}, {(ERRLOG_BASE + 83), "NELOG_LocalSecFail1"}, {(ERRLOG_BASE + 84), "NELOG_LocalSecFail2"}, {(ERRLOG_BASE + 85), "NELOG_LocalSecFail3"}, {(ERRLOG_BASE + 86), "NELOG_LocalSecGeneralFail"}, {(ERRLOG_BASE + 90), "NELOG_NetWkSta_Internal_Error"}, {(ERRLOG_BASE + 91), "NELOG_NetWkSta_No_Resource"}, {(ERRLOG_BASE + 92), "NELOG_NetWkSta_SMB_Err"}, {(ERRLOG_BASE + 93), "NELOG_NetWkSta_VC_Err"}, {(ERRLOG_BASE + 94), "NELOG_NetWkSta_Stuck_VC_Err"}, {(ERRLOG_BASE + 95), "NELOG_NetWkSta_NCB_Err"}, {(ERRLOG_BASE + 96), "NELOG_NetWkSta_Write_Behind_Err"}, {(ERRLOG_BASE + 97), "NELOG_NetWkSta_Reset_Err"}, {(ERRLOG_BASE + 98), "NELOG_NetWkSta_Too_Many"}, {(ERRLOG_BASE + 104), "NELOG_Srv_Thread_Failure"}, {(ERRLOG_BASE + 105), "NELOG_Srv_Close_Failure"}, {(ERRLOG_BASE + 106), "NELOG_ReplUserCurDir"}, {(ERRLOG_BASE + 107), "NELOG_ReplCannotMasterDir"}, {(ERRLOG_BASE + 108), "NELOG_ReplUpdateError"}, {(ERRLOG_BASE + 109), "NELOG_ReplLostMaster"}, {(ERRLOG_BASE + 110), "NELOG_NetlogonAuthDCFail"}, {(ERRLOG_BASE + 111), "NELOG_ReplLogonFailed"}, {(ERRLOG_BASE + 112), "NELOG_ReplNetErr"}, {(ERRLOG_BASE + 113), "NELOG_ReplMaxFiles"}, {(ERRLOG_BASE + 114), "NELOG_ReplMaxTreeDepth"}, {(ERRLOG_BASE + 115), "NELOG_ReplBadMsg"}, {(ERRLOG_BASE + 116), "NELOG_ReplSysErr"}, {(ERRLOG_BASE + 117), "NELOG_ReplUserLoged"}, {(ERRLOG_BASE + 118), "NELOG_ReplBadImport"}, {(ERRLOG_BASE + 119), "NELOG_ReplBadExport"}, {(ERRLOG_BASE + 120), "NELOG_ReplSignalFileErr"}, {(ERRLOG_BASE + 121), "NELOG_DiskFT"}, {(ERRLOG_BASE + 122), "NELOG_ReplAccessDenied"}, {(ERRLOG_BASE + 123), "NELOG_NetlogonFailedPrimary"}, {(ERRLOG_BASE + 124), "NELOG_NetlogonPasswdSetFailed"}, {(ERRLOG_BASE + 125), "NELOG_NetlogonTrackingError"}, {(ERRLOG_BASE + 126), "NELOG_NetlogonSyncError"}, {(ERRLOG_BASE + 127), "NELOG_NetlogonRequireSignOrSealError"}, {(ERRLOG_BASE + 130), "NELOG_UPS_PowerOut"}, {(ERRLOG_BASE + 131), "NELOG_UPS_Shutdown"}, {(ERRLOG_BASE + 132), "NELOG_UPS_CmdFileError"}, {(ERRLOG_BASE + 133), "NELOG_UPS_CannotOpenDriver"}, {(ERRLOG_BASE + 134), "NELOG_UPS_PowerBack"}, {(ERRLOG_BASE + 135), "NELOG_UPS_CmdFileConfig"}, {(ERRLOG_BASE + 136), "NELOG_UPS_CmdFileExec"}, {(ERRLOG_BASE + 150), "NELOG_Missing_Parameter"}, {(ERRLOG_BASE + 151), "NELOG_Invalid_Config_Line"}, {(ERRLOG_BASE + 152), "NELOG_Invalid_Config_File"}, {(ERRLOG_BASE + 153), "NELOG_File_Changed"}, {(ERRLOG_BASE + 154), "NELOG_Files_Dont_Fit"}, {(ERRLOG_BASE + 155), "NELOG_Wrong_DLL_Version"}, {(ERRLOG_BASE + 156), "NELOG_Error_in_DLL"}, {(ERRLOG_BASE + 157), "NELOG_System_Error"}, {(ERRLOG_BASE + 158), "NELOG_FT_ErrLog_Too_Large"}, {(ERRLOG_BASE + 159), "NELOG_FT_Update_In_Progress"}, {(ERRLOG_BASE + 160), "NELOG_Joined_Domain"}, {(ERRLOG_BASE + 199), "NELOG_OEM_Code"}, {(ERRLOG2_BASE + 0), "NELOG_NetlogonSSIInitError"}, {(ERRLOG2_BASE + 1), "NELOG_NetlogonFailedToUpdateTrustList"}, {(ERRLOG2_BASE + 2), "NELOG_NetlogonFailedToAddRpcInterface"}, {(ERRLOG2_BASE + 3), "NELOG_NetlogonFailedToReadMailslot"}, {(ERRLOG2_BASE + 4), "NELOG_NetlogonFailedToRegisterSC"}, {(ERRLOG2_BASE + 5), "NELOG_NetlogonChangeLogCorrupt"}, {(ERRLOG2_BASE + 6), "NELOG_NetlogonFailedToCreateShare"}, {(ERRLOG2_BASE + 7), "NELOG_NetlogonDownLevelLogonFailed"}, {(ERRLOG2_BASE + 8), "NELOG_NetlogonDownLevelLogoffFailed"}, {(ERRLOG2_BASE + 9), "NELOG_NetlogonNTLogonFailed"}, {(ERRLOG2_BASE + 10), "NELOG_NetlogonNTLogoffFailed"}, {(ERRLOG2_BASE + 11), "NELOG_NetlogonPartialSyncCallSuccess"}, {(ERRLOG2_BASE + 12), "NELOG_NetlogonPartialSyncCallFailed"}, {(ERRLOG2_BASE + 13), "NELOG_NetlogonFullSyncCallSuccess"}, {(ERRLOG2_BASE + 14), "NELOG_NetlogonFullSyncCallFailed"}, {(ERRLOG2_BASE + 15), "NELOG_NetlogonPartialSyncSuccess"}, {(ERRLOG2_BASE + 16), "NELOG_NetlogonPartialSyncFailed"}, {(ERRLOG2_BASE + 17), "NELOG_NetlogonFullSyncSuccess"}, {(ERRLOG2_BASE + 18), "NELOG_NetlogonFullSyncFailed"}, {(ERRLOG2_BASE + 19), "NELOG_NetlogonAuthNoDomainController"}, {(ERRLOG2_BASE + 20), "NELOG_NetlogonAuthNoTrustLsaSecret"}, {(ERRLOG2_BASE + 21), "NELOG_NetlogonAuthNoTrustSamAccount"}, {(ERRLOG2_BASE + 22), "NELOG_NetlogonServerAuthFailed"}, {(ERRLOG2_BASE + 23), "NELOG_NetlogonServerAuthNoTrustSamAccount"}, {(ERRLOG2_BASE + 24), "NELOG_FailedToRegisterSC"}, {(ERRLOG2_BASE + 25), "NELOG_FailedToSetServiceStatus"}, {(ERRLOG2_BASE + 26), "NELOG_FailedToGetComputerName"}, {(ERRLOG2_BASE + 27), "NELOG_DriverNotLoaded"}, {(ERRLOG2_BASE + 28), "NELOG_NoTranportLoaded"}, {(ERRLOG2_BASE + 29), "NELOG_NetlogonFailedDomainDelta"}, {(ERRLOG2_BASE + 30), "NELOG_NetlogonFailedGlobalGroupDelta"}, {(ERRLOG2_BASE + 31), "NELOG_NetlogonFailedLocalGroupDelta"}, {(ERRLOG2_BASE + 32), "NELOG_NetlogonFailedUserDelta"}, {(ERRLOG2_BASE + 33), "NELOG_NetlogonFailedPolicyDelta"}, {(ERRLOG2_BASE + 34), "NELOG_NetlogonFailedTrustedDomainDelta"}, {(ERRLOG2_BASE + 35), "NELOG_NetlogonFailedAccountDelta"}, {(ERRLOG2_BASE + 36), "NELOG_NetlogonFailedSecretDelta"}, {(ERRLOG2_BASE + 37), "NELOG_NetlogonSystemError"}, {(ERRLOG2_BASE + 38), "NELOG_NetlogonDuplicateMachineAccounts"}, {(ERRLOG2_BASE + 39), "NELOG_NetlogonTooManyGlobalGroups"}, {(ERRLOG2_BASE + 40), "NELOG_NetlogonBrowserDriver"}, {(ERRLOG2_BASE + 41), "NELOG_NetlogonAddNameFailure"}, {(ERRLOG2_BASE + 42), "NELOG_RplMessages"}, {(ERRLOG2_BASE + 43), "NELOG_RplXnsBoot"}, {(ERRLOG2_BASE + 44), "NELOG_RplSystem"}, {(ERRLOG2_BASE + 45), "NELOG_RplWkstaTimeout"}, {(ERRLOG2_BASE + 46), "NELOG_RplWkstaFileOpen"}, {(ERRLOG2_BASE + 47), "NELOG_RplWkstaFileRead"}, {(ERRLOG2_BASE + 48), "NELOG_RplWkstaMemory"}, {(ERRLOG2_BASE + 49), "NELOG_RplWkstaFileChecksum"}, {(ERRLOG2_BASE + 50), "NELOG_RplWkstaFileLineCount"}, {(ERRLOG2_BASE + 51), "NELOG_RplWkstaBbcFile"}, {(ERRLOG2_BASE + 52), "NELOG_RplWkstaFileSize"}, {(ERRLOG2_BASE + 53), "NELOG_RplWkstaInternal"}, {(ERRLOG2_BASE + 54), "NELOG_RplWkstaWrongVersion"}, {(ERRLOG2_BASE + 55), "NELOG_RplWkstaNetwork"}, {(ERRLOG2_BASE + 56), "NELOG_RplAdapterResource"}, {(ERRLOG2_BASE + 57), "NELOG_RplFileCopy"}, {(ERRLOG2_BASE + 58), "NELOG_RplFileDelete"}, {(ERRLOG2_BASE + 59), "NELOG_RplFilePerms"}, {(ERRLOG2_BASE + 60), "NELOG_RplCheckConfigs"}, {(ERRLOG2_BASE + 61), "NELOG_RplCreateProfiles"}, {(ERRLOG2_BASE + 62), "NELOG_RplRegistry"}, {(ERRLOG2_BASE + 63), "NELOG_RplReplaceRPLDISK"}, {(ERRLOG2_BASE + 64), "NELOG_RplCheckSecurity"}, {(ERRLOG2_BASE + 65), "NELOG_RplBackupDatabase"}, {(ERRLOG2_BASE + 66), "NELOG_RplInitDatabase"}, {(ERRLOG2_BASE + 67), "NELOG_RplRestoreDatabaseFailure"}, {(ERRLOG2_BASE + 68), "NELOG_RplRestoreDatabaseSuccess"}, {(ERRLOG2_BASE + 69), "NELOG_RplInitRestoredDatabase"}, {(ERRLOG2_BASE + 70), "NELOG_NetlogonSessionTypeWrong"}, {(ERRLOG2_BASE + 71), "NELOG_RplUpgradeDBTo40"}, {(ERRLOG2_BASE + 72), "NELOG_NetlogonLanmanBdcsNotAllowed"}, {(ERRLOG2_BASE + 73), "NELOG_NetlogonNoDynamicDns"}, {(ERRLOG2_BASE + 74), "NELOG_NetlogonDynamicDnsRegisterFailure"}, {(ERRLOG2_BASE + 75), "NELOG_NetlogonDynamicDnsDeregisterFailure"}, {(ERRLOG2_BASE + 76), "NELOG_NetlogonFailedFileCreate"}, {(ERRLOG2_BASE + 77), "NELOG_NetlogonGetSubnetToSite"}, {(ERRLOG2_BASE + 78), "NELOG_NetlogonNoSiteForClient"}, {(ERRLOG2_BASE + 79), "NELOG_NetlogonBadSiteName"}, {(ERRLOG2_BASE + 80), "NELOG_NetlogonBadSubnetName"}, {(ERRLOG2_BASE + 81), "NELOG_NetlogonDynamicDnsServerFailure"}, {(ERRLOG2_BASE + 82), "NELOG_NetlogonDynamicDnsFailure"}, {(ERRLOG2_BASE + 83), "NELOG_NetlogonRpcCallCancelled"}, {(ERRLOG2_BASE + 84), "NELOG_NetlogonDcSiteCovered"}, {(ERRLOG2_BASE + 85), "NELOG_NetlogonDcSiteNotCovered"}, {(ERRLOG2_BASE + 86), "NELOG_NetlogonGcSiteCovered"}, {(ERRLOG2_BASE + 87), "NELOG_NetlogonGcSiteNotCovered"}, {(ERRLOG2_BASE + 88), "NELOG_NetlogonFailedSpnUpdate"}, {(ERRLOG2_BASE + 89), "NELOG_NetlogonFailedDnsHostNameUpdate"}, {(ERRLOG2_BASE + 90), "NELOG_NetlogonAuthNoUplevelDomainController"}, {(ERRLOG2_BASE + 91), "NELOG_NetlogonAuthDomainDowngraded"}, {(ERRLOG2_BASE + 92), "NELOG_NetlogonNdncSiteCovered"}, {(ERRLOG2_BASE + 93), "NELOG_NetlogonNdncSiteNotCovered"}, {(ERRLOG2_BASE + 94), "NELOG_NetlogonDcOldSiteCovered"}, {(ERRLOG2_BASE + 95), "NELOG_NetlogonDcSiteNotCoveredAuto"}, {(ERRLOG2_BASE + 96), "NELOG_NetlogonGcOldSiteCovered"}, {(ERRLOG2_BASE + 97), "NELOG_NetlogonGcSiteNotCoveredAuto"}, {(ERRLOG2_BASE + 98), "NELOG_NetlogonNdncOldSiteCovered"}, {(ERRLOG2_BASE + 99), "NELOG_NetlogonNdncSiteNotCoveredAuto"}, {(ERRLOG2_BASE + 100), "NELOG_NetlogonSpnMultipleSamAccountNames"}, {(ERRLOG2_BASE + 101), "NELOG_NetlogonSpnCrackNamesFailure"}, {(ERRLOG2_BASE + 102), "NELOG_NetlogonNoAddressToSiteMapping"}, {(ERRLOG2_BASE + 103), "NELOG_NetlogonInvalidGenericParameterValue"}, {(ERRLOG2_BASE + 104), "NELOG_NetlogonInvalidDwordParameterValue"}, {(ERRLOG2_BASE + 105), "NELOG_NetlogonServerAuthFailedNoAccount"}, {(ERRLOG2_BASE + 106), "NELOG_NetlogonNoDynamicDnsManual"}, {(ERRLOG2_BASE + 107), "NELOG_NetlogonNoSiteForClients"},
{0 , "Event tag not found"}
};
//
// DS Eventlog codes.
//
// DIR_ETYPE_WARNING 0x2
// DIR_ETYPE_SECURITY 0x0
// DIR_ETYPE_INFORMATIONAL 0x1
// DIR_ETYPE_ERROR 0x3
// KCC_CATEGORY ((MessageId)0x00000001L)
// SECURITY_CATEGORY ((MessageId)0x00000002L)
// XDS_INTERFACE_CATEGORY ((MessageId)0x00000003L)
// MAPI_CATEGORY ((MessageId)0x00000004L)
// REPLICATION_CATEGORY ((MessageId)0x00000005L)
// GARBAGE_COLLECTION_CATEGORY ((MessageId)0x00000006L)
// INTERNAL_CONFIGURATION_CATEGORY ((MessageId)0x00000007L)
// DIRECTORY_ACCESS_CATEGORY ((MessageId)0x00000008L)
// INTERNAL_PROCESSING_CATEGORY ((MessageId)0x00000009L)
// PERFORMANCE_CATEGORY ((MessageId)0x0000000AL)
// STARTUP_SHUTDOWN_CATEGORY ((MessageId)0x0000000BL)
// SERVICE_CONTROL_CATEGORY ((MessageId)0x0000000CL)
// NAME_RESOLUTION_CATEGORY ((MessageId)0x0000000DL)
// BACKUP_CATEGORY ((MessageId)0x0000000EL)
// FIELD_ENGINEERING_CATEGORY ((MessageId)0x0000000FL)
// LDAP_INTERFACE_CATEGORY ((MessageId)0x00000010L)
// SETUP_CATEGORY ((MessageId)0x00000011L)
// GC_CATEGORY ((MessageId)0x00000012L)
// ISM_CATEGORY ((MessageId)0x00000013L)
// GROUP_CACHING_CATEGORY ((MessageId)0x00000014L)
// LVR_CATEGORY ((MessageId)0x00000015L)
// DS_RPC_CLIENT_CATEGORY ((MessageId)0x00000016L)
// DS_RPC_SERVER_CATEGORY ((MessageId)0x00000017L)
// DS_SCHEMA_CATEGORY ((MessageId)0x00000018L)
// ALERT_TEMPLATE ((MessageId)0x00000320L)
// Below is built from E:\nt\ds\ds\src\idl\mdcodes.mc
FRS_EL_ENTRY DirSvcEvents[] = { {0x400003E8, "DIRLOG_STARTED"}, {0x400003E9, "DIRLOG_START_FAILED"}, {0x400003EA, "DIRLOG_INSTALLED"}, {0xC00003EB, "DIRLOG_DBINIT_FAILED"}, {0x400003EC, "DIRLOG_NORMAL_SHUTDOWN"}, {0x400003ED, "DIRLOG_GC_STARTED"}, {0x400003EE, "DIRLOG_GC_COMPLETED"}, {0x400003EF, "DIRLOG_CHK_INIT_SUCCESS"}, {0xC00003F0, "DIRLOG_CHK_INIT_FAILURE"}, {0x400003F1, "DIRLOG_CHK_UPDATE_REPL_TOPOLOGY_BEGIN"}, {0xC00003F2, "DIRLOG_NO_MEMORY_FOR_LOG_OVERRIDES"}, {0x400003F3, "DIRLOG_SERVICE_GARBAGE_COLLECT"}, {0x400003F4, "DIRLOG_SERVICE_UNKNOWN"}, {0x400003F5, "DIRLOG_CHK_UPDATE_REPL_TOPOLOGY_END_NORMAL"}, {0x800003F6, "DIRLOG_CHK_UPDATE_REPL_TOPOLOGY_END_ABNORMAL"}, {0x400003F7, "DIRLOG_CHK_STOP_SUCCESS"}, {0xC00003F8, "DIRLOG_SCHEMA_NOT_LOADED"}, {0xC00003F9, "DIRLOG_PREFIX_LOAD_FAILED"}, {0xC00003FA, "DIRLOG_CONFIG_PARAM_MISSING"}, {0xC00003FB, "DIRLOG_CANT_REMOVE_ATT_CACHE"}, {0xC00003FC, "DIRLOG_BAD_CONT_REF"}, {0xC00003FD, "DIRLOG_CANT_REPLACE_HIDDEN_REC"}, {0xC00003FE, "DIRLOG_READ_CACHE_SKIPPED"}, {0xC00003FF, "DIRLOG_CODE_INCONSISTENCY"}, {0xC0000400, "DIRLOG_CHK_STOP_FAILURE"}, {0xC0000401, "DIRLOG_CANT_RETRIEVE_DN"}, {0xC0000402, "DIRLOG_CANT_RETRIEVE_RDN"}, {0xC0000403, "DIRLOG_CANT_RETRIEVE_INSTANCE"}, {0xC0000404, "DIRLOG_CANT_RETRIEVE_CHILD"}, {0xC0000405, "DIRLOG_NAME_MISSING_ON_ALIAS"}, {0xC0000406, "DIRLOG_BAD_ATT_SCHEMA_SYNTAX"}, {0xC0000407, "DIRLOG_NCNAME_MISSING_CR_REF"}, {0xC0000408, "DIRLOG_GOVERNSID_MISSING"}, {0xC0000409, "DIRLOG_CANT_CACHE_CLASS"}, {0xC000040A, "DIRLOG_CANT_REMOVE_CLASS_CACHE"}, {0xC000040B, "DIRLOG_ATT_SCHEMA_REQ_ID"}, {0xC000040C, "DIRLOG_ATT_SCHEMA_REQ_SYNTAX"}, {0xC000040D, "DIRLOG_MISSING_EXPECTED_ATT"}, {0xC000040E, "DIRLOG_CANT_FIND_DSA_OBJ"}, {0xC000040F, "DIRLOG_DATABASE_ERROR"}, {0xC0000410, "DIRLOG_CANT_FIND_NC_IN_CACHE"}, {0xC0000411, "DIRLOG_CANT_FIND_EXPECTED_NC"}, {0xC0000412, "DIRLOG_CANT_FIND_SUBREF_LIST"}, {0xC0000413, "DIRLOG_CANT_FIND_DSA_NAME"}, {0xC0000414, "DIRLOG_CANT_FIND_NODE_ADDRESS"}, {0x40000415, "DIRLOG_DRA_REPLICAMODIFY_ENTRY"}, {0xC0000416, "DIRLOG_JET_FAULTED"}, {0xC0000417, "DIRLOG_MISSING_CROSS_REF"}, {0xC0000418, "DIRLOG_MASTERDSA_MISSING_CR_REF"}, {0xC0000419, "DIRLOG_MISSING_SUPREF"}, {0xC000041A, "DIRLOG_UNUSED_1"}, {0xC000041B, "DIRLOG_LOOP_DETECTED"}, {0xC000041C, "DIRLOG_MASTERDSA_MISSING_SUBREF"}, {0xC000041D, "DIRLOG_CANT_CACHE_ATT"}, {0xC000041E, "DIRLOG_SECURITY_CHECKING_ERROR"}, {0x4000041F, "DIRLOG_SECURITY_ACCESS_GRANTED_SD"}, {0x40000420, "DIRLOG_SECURITY_ACCESS_GRANTED_DEFAULT"}, {0x80000421, "DIRLOG_SECURITY_ACCESS_DENIED"}, {0x00000422, "DIRLOG_SECURITY_ILLEGAL_MODIFY"}, {0x40000423, "DIRLOG_DRA_SET_UUID"}, {0x40000424, "DIRLOG_DRA_CALL_EXIT_OK"}, {0x80000425, "DIRLOG_DRA_CALL_EXIT_BAD"}, {0x40000426, "DIRLOG_CHK_LINK_DEL_NONC_BUSY"}, {0x40000427, "DIRLOG_CHK_LINK_DEL_NOTGC_BUSY"}, {0x40000428, "DIRLOG_CHK_LINK_DEL_DOMDEL_BUSY"}, {0x80000429, "DIRLOG_CHK_LINK_DEL_NOCONN_BUSY"}, {0x4000042A, "DIRLOG_DRA_REPLICAADD_ENTRY"}, {0x4000042B, "DIRLOG_DRA_REPLICADEL_ENTRY"}, {0x4000042C, "DIRLOG_DRA_UPDATEREFS_ENTRY"}, {0x4000042D, "DIRLOG_CHK_LINK_DEL_NOSRC_BUSY"}, {0x4000042E, "DIRLOG_DRA_REPLICASYNC_ENTRY"}, {0xC000042F, "DIRLOG_UNUSED_7"}, {0x40000430, "DIRLOG_DRA_GETNCCH_ENTRY"}, {0x40000431, "DIRLOG_DRA_GETNCCH_EXIT"}, {0x80000432, "DIRLOG_DRA_UPDREP_PICFAULT"}, {0x80000433, "DIRLOG_DRA_REQUPD_PICFAULT"}, {0x40000434, "DIRLOG_RPC_UNUSED_0"}, {0xC0000435, "DIRLOG_DRA_PR_ALLOC_FAIL"}, {0x40000436, "DIRLOG_PERF_OPEN"}, {0x80000437, "DIRLOG_DRA_OUT_OF_MEMORY"}, {0x80000438, "DIRLOG_DRA_NOTIFY_FAILED"}, {0x80000439, "DIRLOG_DRA_IDUPDATE_FAILED"}, {0x8000043A, "DIRLOG_DRA_IDREQUEST_FAILED"}, {0x8000043B, "DIRLOG_DRA_UPDATE_FAILURE"}, {0xC000043C, "DIRLOG_DRA_UPDATE_FAILURE_NOT_BUSY"}, {0x8000043D, "DIRLOG_DRA_SYNC_FAILURE"}, {0xC000043E, "DIRLOG_UNUSED_10"}, {0x4000043F, "DIRLOG_CANT_FIND_REG_PARM"}, {0x80000440, "DIRLOG_DRA_CONFIG_MISMATCH"}, {0x40000441, "DIRLOG_DSP_CONFIG_INVALID"}, {0xC0000442, "DIRLOG_CHK_INVALID_TRANSPORT_FOR_WRITEABLE_DOMAIN_NC"}, {0x80000443, "DIRLOG_CHK_CANT_REPLICATE_FROM_SELF"}, {0x80000444, "DIRLOG_DRA_RECORD_TOO_BIG_PRUNE_FAILURE"}, {0x80000445, "DIRLOG_DRA_RECORD_TOO_BIG_OVERRIDE"}, {0x80000446, "DIRLOG_DISABLE_DISK_WRITE_CACHE"}, {0x80000447, "DIRLOG_DRA_MAIL_REQUPD_BADMSG"}, {0x80000448, "DIRLOG_DRA_MAIL_UPDREP_BADMSG"}, {0x80000449, "DIRLOG_DRA_MAIL_REQUPD_BADNC"}, {0x8000044A, "DIRLOG_DRA_MAIL_UPDREP_BADNC"}, {0x8000044B, "DIRLOG_DRA_MAIL_REQUPD_BADSRC"}, {0x8000044C, "DIRLOG_DRA_MAIL_UPDREP_BADSRC"}, {0x4000044D, "DIRLOG_DRA_RECORD_TOO_BIG_SUCCESS"}, {0x4000044E, "DIRLOG_DRA_MAIL_REQ_UPD_SENT"}, {0x4000044F, "DIRLOG_DRA_MAIL_UPD_REP_SENT"}, {0x40000450, "DIRLOG_CHK_REPSTO_DEL_SUCCESS"}, {0x80000451, "DIRLOG_CHK_REPSTO_DEL_FAILURE"}, {0x80000452, "DIRLOG_DRA_DISPATCHER_TIMEOUT"}, {0xC0000453, "DIRLOG_DRA_DISPATCHER_DEAD"}, {0x40000454, "DIRLOG_KCC_CANDIDATE_CONNECTIONS"}, {0x40000455, "DIRLOG_DRA_INVOCATION_ID_CHANGED"}, {0x40000456, "DIRLOG_GC_PROMOTION_DELAYED"}, {0x40000457, "DIRLOG_DRA_UPDATENC_PROGRESS"}, {0x80000458, "DIRLOG_DRA_DISP_DEAD_DETAILS"}, {0x80000459, "DIRLOG_DRA_DISABLED_INBOUND_REPL"}, {0x4000045A, "DIRLOG_DRA_REENABLED_INBOUND_REPL"}, {0x8000045B, "DIRLOG_DRA_DISABLED_OUTBOUND_REPL"}, {0x4000045C, "DIRLOG_DRA_REENABLED_OUTBOUND_REPL"}, {0x8000045D, "DIRLOG_CHK_ALL_CONNECTIONS_FOR_NC_DISABLED"}, {0xC000045E, "DIRLOG_CHK_NO_LOCAL_SOURCE_FOR_NC"}, {0x4000045F, "DIRLOG_GC_PROMOTED"}, {0x40000460, "DIRLOG_GC_DEMOTED"}, {0xC0000461, "DIRLOG_CHK_BAD_SCHEDULE"}, {0x40000462, "DIRLOG_DRA_DELETED_PARENT"}, {0x40000463, "DIRLOG_CHK_REMOVED_CONN_FROM_DEAD_SERVER"}, {0x40000464, "DIRLOG_DRA_GET_RPC_HANDLE_FAILURE"}, {0xC0000465, "DIRLOG_RPC_CONNECTION_FAILED"}, {0xC0000466, "DIRLOG_GCVERIFY_ERROR"}, {0xC0000467, "DIRLOG_DRA_NC_HEAD_NAME_CONFLICT"}, {0x40000468, "DIRLOG_KCC_CONNECTION_OBJECT_CREATED"}, {0x40000469, "DIRLOG_KCC_CONNECTION_OBJECT_DELETED"}, {0xC000046A, "DIRLOG_KCC_AUTO_TOPL_GENERATION_INCOMPLETE"}, {0x4000046B, "DIRLOG_KCC_ERROR_CREATING_CONNECTION_OBJECT"}, {0x4000046C, "DIRLOG_GC_REMOVED_OBJECT"}, {0x4000046D, "DIRLOG_KCC_SITE_GENERATOR"}, {0x8000046E, "DIRLOG_CHK_DUPLICATE_CONNECTION"}, {0xC000046F, "DIRLOG_SCHEMA_SEARCH_FAILED"}, {0x40000470, "DIRLOG_SCHEMA_CREATE_INDEX_FAILED"}, {0x40000471, "DIRLOG_SCHEMA_INDEX_CREATED"}, {0x40000472, "DIRLOG_API_TRACE"}, {0x40000473, "DIRLOG_API_TRACE_COMPLETE"}, {0xC0000474, "DIRLOG_SCHEMA_ALLOC_FAILED"}, {0xC0000475, "DIRLOG_SCHEMA_BOGUS_SEARCH"}, {0xC0000476, "DIRLOG_SCHEMA_INVALID_AUX"}, {0xC0000477, "DIRLOG_SCHEMA_NOT_AUX"}, {0xC0000478, "DIRLOG_SCHEMA_AUXILIARY_INHERIT_STRUCTURAL"}, {0xC0000479, "DIRLOG_SCHEMA_ABSTRACT_INHERIT_NON_ABSTRACT"}, {0xC000047A, "DIRLOG_SCHEMA_STRUCTURAL_WITH_MULT_INHERIT"}, {0xC000047B, "DIRLOG_SCHEMA_MISSING_ATT_ID"}, {0x8000047C, "DIRLOG_SCHEMA_SURPLUS_INFO"}, {0x4000047D, "DIRLOG_SCHEMA_CREATING_COLUMN"}, {0xC000047E, "DIRLOG_SCHEMA_COLUMN_ADD_FAILED"}, {0x4000047F, "DIRLOG_SCHEMA_COLUMN_ADDED"}, {0xC0000480, "DIRLOG_SCHEMA_CIRCULAR_INHERIT"}, {0x80000481, "DIRLOG_SCHEMA_INVALID_SUPER"}, {0x40000482, "DIRLOG_SCHEMA_INVALID_RDN"}, {0x40000483, "DIRLOG_SCHEMA_INVALID_MUST"}, {0x40000484, "DIRLOG_SCHEMA_INVALID_MAY"}, {0x40000485, "DIRLOG_SCHEMA_CREATING_INDEX"}, {0xC0000486, "DIRLOG_DELAYED_FREE_FAILED"}, {0xC0000487, "DIRLOG_BAD_CHAR_FOR_LOG_OVERRIDES"}, {0xC0000488, "DIRLOG_BAD_CHAR_COUNT_FOR_LOG_OVERRIDES"}, {0xC0000489, "DIRLOG_BUILD_HIERARCHY_TABLE_FAILED"}, {0x4000048A, "DIRLOG_BUILD_HIERARCHY_TABLE_SUCCEEDED"}, {0x4000048B, "DIRLOG_HIERARCHY_TABLE_MALLOC_FAILED"}, {0x8000048C, "DIRLOG_TOO_MANY_OVERRIDES"}, {0xC000048D, "DIRLOG_GET_GUID_FAILED"}, {0x4000048E, "DIRLOG_QUERY_INDEX_CONSIDERED"}, {0x4000048F, "DIRLOG_QUERY_INDEX_CHOSEN"}, {0xC0000490, "DIRLOG_INTERNAL_FAILURE"}, {0xC0000491, "DIRLOG_MALLOC_FAILURE"}, {0xC0000492, "DIRLOG_ASSERTION_FAILURE"}, {0x80000493, "DIRLOG_EXIT_WITH_ACTIVE_THREADS"}, {0x40000494, "DIRLOG_RPC_CONNECTION"}, {0x80000495, "DIRLOG_EXCEPTION"}, {0x40000496, "DIRLOG_PRIVILEGED_OPERATION_PERFORMED"}, {0x40000497, "DIRLOG_PRIVILEGED_OPERATION_FAILED"}, {0x40000498, "DIRLOG_UNAUTHENTICATED_LOGON"}, {0x40000499, "DIRLOG_SECURITY_ATTS_MODIFIED"}, {0x8000049A, "DIRLOG_BAD_LANGUAGE"}, {0x8000049B, "DIRLOG_BAD_CODEPAGE"}, {0x4000049C, "DIRLOG_SCHEMA_DELETE_COLUMN_FAIL"}, {0x4000049D, "DIRLOG_SCHEMA_DELETED_COLUMN_IN_USE"}, {0x4000049E, "DIRLOG_SCHEMA_DELETED_COLUMN"}, {0xC000049F, "DIRLOG_UNUSED_12"}, {0x400004A0, "DIRLOG_SCHEMA_DELETE_INDEX_FAIL"}, {0x400004A1, "DIRLOG_SCHEMA_DELETED_INDEX"}, {0x800004A2, "DIRLOG_DRA_INCOMPAT_MAIL_MSG_P"}, {0x800004A3, "DIRLOG_DRA_INCOMPAT_MAIL_MSG_C"}, {0xC00004A4, "DIRLOG_DRA_DISPATCHER_VILLIAN"}, {0xC00004A5, "DIRLOG_ABNORMAL_EXIT"}, {0x400004A6, "DIRLOG_DRA_RPC_EXCEPTION"}, {0x400004A7, "DIRLOG_DRA_CALL_EXIT_WARN"}, {0x400004A8, "DIRLOG_DRA_ADUPD_INC_SRC"}, {0x400004A9, "DIRLOG_DRA_ADUPD_DEC_SRC"}, {0x400004AA, "DIRLOG_DRA_ADUPD_NC_SYNCED"}, {0x400004AB, "DIRLOG_DRA_ADUPD_ALL_SYNCED"}, {0xC00004AC, "DIRLOG_CANT_APPLY_SERVER_SECURITY"}, {0x400004AD, "DIRLOG_KCC_NC_SITE_TOPOLOGY"}, {0x400004AE, "DIRLOG_RECOVER_RESTORED_FAILED"}, {0x400004AF, "DIRLOG_SCHEMA_DELETE_LOCALIZED_INDEX_FAIL"}, {0x400004B0, "DIRLOG_SCHEMA_DELETED_LOCALIZED_INDEX"}, {0x400004B1, "DIRLOG_MAIL_COMPRESSED"}, {0xC00004B2, "DIRLOG_DRA_BAD_NC"}, {0x400004B3, "DIRLOG_DRA_SCHEMA_MISMATCH"}, {0xC00004B4, "DIRLOG_ATQ_WRITE_COMPLETION_LIGHT"}, {0xC00004B5, "DIRLOG_SDPROP_OBJ_CLASS_PROBLEM"}, {0xC00004B6, "DIRLOG_ATQ_UDP_WRITE_COMPLETION_ERROR"}, {0xC00004B7, "DIRLOG_SCHEMA_CACHE_UPDATE_RETRY"}, {0xC00004B8, "DIRLOG_SCHEMA_CACHE_UPDATE_FAILED"}, {0xC00004B9, "DIRLOG_AUDIT_PRIVILEGE_FAILED"}, {0xC00004BA, "DIRLOG_ATQ_MAX_CONNECTIONS_EXCEEDED"}, {0x400004BB, "DIRLOG_ATQ_CLOSE_SOCKET_SHUTDOWN"}, {0x400004BC, "DIRLOG_ATQ_MULTI_PACKET_UDP"}, {0x400004BD, "DIRLOG_ATQ_CLOSE_SOCKET_CONTACT_LOST"}, {0x800004BE, "DIRLOG_SDPROP_NO_SD"}, {0x400004BF, "DIRLOG_ATQ_CLOSE_SOCKET_OK"}, {0x800004C0, "DIRLOG_ATQ_CLOSE_SOCKET_ERROR"}, {0x800004C1, "DIRLOG_LDAP_NTLM_WARNING"}, {0x800004C2, "DIRLOG_LDAP_NEGOTIATE_WARNING"}, {0x800004C3, "DIRLOG_LDAP_SIMPLE_WARNING"}, {0x400004C4, "DIRLOG_LDAP_SSL_NO_CERT"}, {0x400004C5, "DIRLOG_LDAP_SSL_GOT_CERT"}, {0xC00004C6, "DIRLOG_DRA_CERT_ACCESS_DENIED_WINERR"}, {0xC00004C7, "DIRLOG_DRA_CERT_ACCESS_DENIED_TRUSTERR"}, {0x800004C8, "DIRLOG_SERVER_INFO_UPDATE_FAILED"}, {0x400004C9, "DIRLOG_DRA_NAME_CONFLICT_ON_RENAME"}, {0x400004CA, "DIRLOG_DRA_NAME_CONFLICT_ON_ADD"}, {0x400004CB, "DIRLOG_PERF_CLOSE"}, {0xC00004CC, "DIRLOG_PERF_FAIL_QUERY_REG"}, {0xC00004CD, "DIRLOG_PERF_FAIL_OPEN_MEMORY"}, {0xC00004CE, "DIRLOG_PERF_FAIL_MAP_MEMORY"}, {0xC00004CF, "DIRLOG_PERF_FAIL_OPEN_REG"}, {0x800004D0, "DIRLOG_DRA_DISPATCHER_CANCELED"}, {0x400004D1, "DIRLOG_REPLICATION_REPLACE_EQUAL"}, {0xC00004D2, "DIRLOG_FAILED_LOOKUP_ACCOUNT_SID"}, {0xC00004D3, "DIRLOG_OABGEN_FAIL_CREATE_MESSAGE"}, {0xC00004D4, "DIRLOG_WRONG_SERVER_NAME"}, {0xC00004D5, "DIRLOG_SAM_LOOPBACK_ERROR"}, {0xC00004D6, "DIRLOG_LDAP_SSP_ERROR"}, {0x400004D7, "DIRLOG_DRA_PROPERTY_FILTERED"}, {0x400004D8, "DIRLOG_DRA_PROPERTY_NOT_FILTERED"}, {0xC00004D9, "DIRLOG_NO_MORE_OIDS"}, {0xC00004DA, "DIRLOG_BACKUP_REGISTRY"}, {0xC00004DB, "DIRLOG_BACKUP_NOT_DONE"}, {0xC00004DC, "DIRLOG_BACKUP_JET_BACKUP_FAILED"}, {0xC00004DD, "DIRLOG_BACKUP_UNABLE_TO_RECOVER"}, {0xC00004DE, "DIRLOG_BACKUP_THREAD_INIT_FAILED"}, {0x400004DF, "DIRLOG_SEC_PRINCIPAL_NOT_TRANSFERRED"}, {0xC00004E0, "DIRLOG_RESTORE_UNABLE_TO_RESET_TRIGGER"}, {0xC00004E1, "DIRLOG_RESTORE_CANT_READ_DB_PATHS"}, {0xC00004E2, "DIRLOG_RESTORE_UNABLE_TO_CREATE_SD"}, {0xC00004E3, "DIRLOG_RESTORE_FAILED_NOT_RECOVERED_ORIGINAL"}, {0xC00004E4, "DIRLOG_RESTORE_FAILED_RECOVERED_ORIGINAL"}, {0xC00004E5, "DIRLOG_RESTORE_CREATE_DBDIR_FAILED"}, {0xC00004E6, "DIRLOG_RESTORE_RENAME_DBDIR_FAILED"}, {0x400004E7, "DIRLOG_RESTORE_SUCCESSFUL"}, {0xC00004E8, "DIRLOG_CANT_FIND_PARTITIONS_OBJ"}, {0x400004E9, "DIRLOG_SDPROP_DOING_PROPAGATION"}, {0x400004EA, "DIRLOG_SDPROP_REPORT_ON_PROPAGATION"}, {0x400004EB, "DIRLOG_SDPROP_STARTING"}, {0x400004EC, "DIRLOG_SDPROP_SLEEP"}, {0x400004ED, "DIRLOG_SDPROP_AWAKE"}, {0xC00004EE, "DIRLOG_SDPROP_END_ABNORMAL"}, {0x400004EF, "DIRLOG_SDPROP_END_NORMAL"}, {0x400004F0, "DIRLOG_CHK_LINK_ADD_SUCCESS"}, {0x800004F1, "DIRLOG_CHK_LINK_ADD_FAILURE"}, {0x400004F2, "DIRLOG_CHK_LINK_DEL_NOSRC_SUCCESS"}, {0x400004F3, "DIRLOG_CHK_LINK_DEL_NOSRC_FAILURE"}, {0x400004F4, "DIRLOG_CHK_LINK_DEL_NOTGC_SUCCESS"}, {0x400004F5, "DIRLOG_CHK_LINK_DEL_NOTGC_FAILURE"}, {0x400004F6, "DIRLOG_CHK_LINK_DEL_DOMDEL_SUCCESS"}, {0x400004F7, "DIRLOG_CHK_LINK_DEL_DOMDEL_FAILURE"}, {0x400004F8, "DIRLOG_CHK_LINK_DEL_NOCONN_SUCCESS"}, {0x400004F9, "DIRLOG_CHK_LINK_DEL_NOCONN_FAILURE"}, {0x400004FA, "DIRMSG_INSTALL_FAILED_REPLICATION"}, {0x400004FB, "DIRMSG_INSTALL_FAILED_NC_CREATE"}, {0x400004FC, "DIRMSG_INSTALL_FAILED_TO_CREATE_OBJECT"}, {0x400004FD, "DIRMSG_INSTALL_FAILED_TO_CREATE_NTDSA_OBJECT"}, {0x400004FE, "DIRMSG_INSTALL_FAILED_TO_CREATE_DOMAIN_OBJECT"}, {0x400004FF, "DIRMSG_INSTALL_FAILED_TO_INIT_JET"}, {0x40000500, "DIRMSG_INSTALL_FAILED_GENERAL"}, {0x40000501, "DIRMSG_INSTALL_FAILED_LDAP_CONNECT"}, {0x40000502, "DIRMSG_INSTALL_FAILED_BIND"}, {0x40000503, "DIRMSG_INSTALL_FAILED_SITE"}, {0x40000504, "DIRMSG_INSTALL_FAILED_SITE_EXIST"}, {0x40000505, "DIRLOG_INSTALL_SERVER_EXISTS"}, {0x40000506, "DIRLOG_INSTALL_FAILED_TO_DELETE_SERVER"}, {0x40000507, "DIRLOG_INSTALL_DOMAIN_EXISTS"}, {0x40000508, "DIRLOG_INSTALL_FAILED_TO_DELETE_DOMAIN"}, {0x40000509, "DIRLOG_INSTALL_FAILED_JOIN_THE_ENTERPRISE"}, {0x4000050A, "DIRLOG_INSTALL_FAILED_REGISTRY"}, {0x4000050B, "DIRLOG_INSTALL_FAILED_PERF_COUNTERS"}, {0x4000050C, "DIRLOG_INSTALL_FAILED_LOAD_SAM_DB"}, {0x4000050D, "DIRLOG_INSTALL_FAILED_CREATE_NEW_ACCOUNT_INFO"}, {0x4000050E, "DIRLOG_INSTALL_FAILED_CA_ENROLLMENT"}, {0x4000050F, "DIRLOG_INSTALL_FAILED_CREATE_BOOT_OPTION"}, {0x40000510, "DIRLOG_INSTALL_FAILED_ENVIRONMENT"}, {0x40000511, "DIRLOG_INSTALL_FAILED_GENERAL"}, {0x40000512, "DIRMSG_INSTALL_FAILED_LDAP_READ_CONFIG"}, {0x40000513, "DIRMSG_INSTALL_FAILED_SCHEMA_CHECK"}, {0x40000514, "DIRMSG_INSTALL_CANNOT_DERIVE_DN"}, {0x40000515, "DIRMSG_INSTALL_SAM_FAILED"}, {0x40000516, "DIRMSG_INSTALL_DS_CORE_INSTALL_FAILED"}, {0x40000517, "DIRLOG_DEMOTE_DS_DOMAIN_STATUS"}, {0x40000518, "DIRLOG_DEMOTE_IS_OPERATION_VALID"}, {0x40000519, "DIRLOG_DEMOTE_IS_PARTIAL_SHUTDOWN"}, {0x4000051A, "DIRLOG_KCC_CONNECTION_OBJECT_DELETION_FAILED"}, {0x4000051B, "DIRLOG_KCC_CONNECTION_NOT_INSTANTIATED"}, {0x4000051C, "DIRLOG_KCC_REPLICA_LINK_DOWN"}, {0xC000051D, "DIRLOG_WINSOCK_INIT_FAILED"}, {0x4000051E, "DIRLOG_RPC_PROTSEQ_FAILED"}, {0xC000051F, "DIRLOG_KCC_NO_SPANNING_TREE"}, {0xC0000520, "DIRLOG_ISM_TRANSPORT_FAILURE"}, {0x80000521, "DIRLOG_CHK_CONFIG_PARAM_TOO_LOW"}, {0x80000522, "DIRLOG_CHK_CONFIG_PARAM_TOO_HIGH"}, {0xC0000523, "DIRLOG_SCHEMA_CLOSURE_FAILURE"}, {0x40000524, "DIRLOG_KCC_KEEPING_INTERSITE_CONN"}, {0x40000525, "DIRLOG_LDAP_CONNECTION_TIMEOUT"}, {0x40000526, "DIRMSG_DEMOTE_INIT"}, {0x40000527, "DIRMSG_DEMOTE_ENTERPRISE_VALIDATE"}, {0x40000528, "DIRMSG_AUTHENTICATING"}, {0x40000529, "DIRMSG_DEMOTE_NEW_ACCOUNT_INFO"}, {0x4000052A, "DIRMSG_DEMOTE_SAM"}, {0x4000052B, "DIRMSG_DEMOTE_LSA"}, {0x4000052C, "DIRMSG_DEMOTE_REMOVING_EXTERNAL_REFS"}, {0x4000052D, "DIRMSG_DEMOTE_REMOVING_FSMOS"}, {0x4000052E, "DIRMSG_DEMOTE_SHUTTING_DOWN_INTERFACES"}, {0x4000052F, "DIRMSG_DEMOTE_COMPLETING"}, {0x40000530, "DIRMSG_INSTALL_INITIALIZATION"}, {0x40000531, "DIRMSG_INSTALL_VALIDATING_PARAMS"}, {0x40000532, "DIRMSG_INSTALL_FINDING_SITE"}, {0x40000533, "DIRMSG_INSTALL_CONTEXT"}, {0x40000534, "DIRMSG_INSTALL_SITE_EXIST"}, {0x40000535, "DIRMSG_INSTALL_SERVER_EXIST"}, {0x40000536, "DIRMSG_INSTALL_DOMAIN_EXIST"}, {0x40000537, "DIRMSG_INSTALL_CONFIGURE_LOCAL"}, {0x40000538, "DIRMSG_INSTALL_SETTING_PERF"}, {0x40000539, "DIRMSG_INSTALL_SECURITY"}, {0x4000053A, "DIRMSG_INSTALL_REPLICATING_SCHEMA"}, {0x4000053B, "DIRMSG_INSTALL_CREATE_PROGRESS"}, {0x4000053C, "DIRMSG_INSTALL_REPLICATING_CONFIG"}, {0x4000053D, "DIRMSG_INSTALL_CREATING_CONFIG"}, {0x4000053E, "DIRMSG_INSTALL_REPLICATING_DOMAIN"}, {0x4000053F, "DIRMSG_INSTALL_CREATING_DOMAIN"}, {0x40000540, "DIRMSG_INSTALL_CREATING_LOCAL_DS"}, {0x40000541, "DIRMSG_INSTALL_UPGRADING_SAM"}, {0x40000542, "DIRMSG_INSTALL_CREATING_SAM"}, {0x40000543, "DIRMSG_INSTALL_COMPLETING"}, {0x40000544, "DIRLOG_BEGIN_DIR_SEARCH"}, {0x40000545, "DIRLOG_END_DIR_SEARCH"}, {0x40000546, "DIRLOG_BEGIN_DIR_ADDENTRY"}, {0x40000547, "DIRLOG_END_DIR_ADDENTRY"}, {0x40000548, "DIRLOG_BEGIN_DIR_REMOVE"}, {0x40000549, "DIRLOG_END_DIR_REMOVE"}, {0x4000054A, "DIRLOG_BEGIN_DIR_MODIFY"}, {0x4000054B, "DIRLOG_END_DIR_MODIFY"}, {0x4000054C, "DIRLOG_BEGIN_DIR_MODIFYDN"}, {0x4000054D, "DIRLOG_END_DIR_MODIFYDN"}, {0x4000054E, "DIRLOG_BEGIN_DIR_COMPARE"}, {0x4000054F, "DIRLOG_END_DIR_COMPARE"}, {0x40000550, "DIRLOG_DRA_REPLICASYNC_EXIT"}, {0x40000551, "DIRMSG_INSTALL_CREATING_REMOTE"}, {0x40000552, "DIRMSG_INSTALL_REPLICATE_FULL"}, {0x40000553, "DIRLOG_DRA_IMPROVING_UPTODATE_VECTOR"}, {0x40000554, "DIRLOG_DRA_IMPROVING_USN_VECTOR"}, {0x40000555, "DIRLOG_DRA_APPLYING_OBJ_CREATION"}, {0x40000556, "DIRLOG_DRA_APPLYING_OBJ_UPDATE"}, {0x40000557, "DIRMSG_INSTALL_REPLICATE_PROGRESS"}, {0x80000558, "DIRLOG_ISM_LDAP_BASE_SEARCH_FAILED"}, {0x80000559, "DIRLOG_ISM_LDAP_ONELEVEL_SEARCH_FAILED"}, {0x4000055A, "DIRLOG_ISM_SEND_SUCCESS"}, {0x8000055B, "DIRLOG_ISM_SEND_FAILURE"}, {0x4000055C, "DIRLOG_ISM_RECEIVE_SUCCESS"}, {0xC000055D, "DIRLOG_ISM_RECEIVE_FAILURE"}, {0xC000055E, "DIRLOG_ISM_GET_CONNECTIVITY_FAILURE"}, {0xC000055F, "DIRLOG_ISM_GET_TRANSPORT_SERVERS_FAILURE"}, {0xC0000560, "DIRLOG_ISM_GET_CONECTION_SCHEDULE_FAILURE"}, {0xC0000561, "DIRLOG_ISM_TRANSPORT_LOAD_FAILURE"}, {0xC0000562, "DIRLOG_ISM_TRANSPORT_REFRESH_FAILURE"}, {0x40000563, "DIRLOG_ISM_MESSAGE_PENDING"}, {0x80000564, "DIRLOG_ISM_TRANSPORT_MONITOR_FAILURE"}, {0xC0000565, "DIRLOG_ISM_SITELINK_INVALID_SCHEDULE_FORMAT"}, {0xC0000566, "DIRLOG_ISM_SITELINK_SCHEDULE_NEVER"}, {0xC0000567, "DIRLOG_DRA_NO_CERTIFICATE"}, {0x40000568, "DIRLOG_DRA_CERTIFICATE_ACQUIRED"}, {0xC0000569, "DIRLOG_ISM_IP_RPC_REG_FAILED"}, {0x4000056A, "DIRLOG_UNUSED_2"}, {0xC000056B, "DIRLOG_ISM_IP_MESSAGE_DROPPED"}, {0xC000056C, "DIRLOG_DRA_MISSING_OBJECT"}, {0xC000056D, "DIRLOG_DEMOTE_SAM_FAILED"}, {0xC000056E, "DIRLOG_DEMOTE_LSA_FAILED"}, {0xC000056F, "DIRLOG_DEMOTE_SET_MACHINE_ACC_FAILED"}, {0x40000570, "DIRLOG_DEMOTE_FAILED_TO_UPDATE_EXTN"}, {0xC0000571, "DIRLOG_STOPPED_NETLOGON"}, {0x40000572, "DIRLOG_RESTARTED_NETLOGON"}, {0x40000573, "DIRMSG_DEMOTE_FAILED_TO_ABANDON_DOMAIN_FSMOS"}, {0xC0000574, "DIRMSG_DEMOTE_FAILED_TO_ABANDON_ENTERPRISE_FSMOS"}, {0x40000575, "DIRMSG_DEMOTE_ABANDONING_DOMAIN_FSMOS"}, {0x40000576, "DIRMSG_DEMOTE_ABANDONING_ENTERPRISE_FSMOS"}, {0xC0000577, "DIRMSG_INSTALL_FAILED_TO_MOVE_BOOT_SCHEMA"}, {0xC0000578, "DIRMSG_FAILED_SET_PRODUCT_TYPE"}, {0x40000579, "DIRLOG_KCC_CONNECTION_EDGE_NEEDED"}, {0x4000057A, "DIRMSG_DBDUMP_SUCCESS"}, {0xC000057B, "DIRMSG_DBDUMP_FAILURE"}, {0x4000057C, "DIRLOG_CHK_CLAIMED_SITE_GENERATOR_ROLE"}, {0xC000057D, "DIRLOG_ISM_SMTP_MSG_UNREADABLE"}, {0x8000057E, "DIRLOG_ISM_SMTP_NOTIFY_FAILED"}, {0xC000057F, "DIRLOG_ISM_LDAP_MODIFY_FAILED"}, {0x40000580, "DIRLOG_ISM_SMTP_MAIL_ADDRESS"}, {0x80000581, "DIRLOG_ISM_SMTP_NO_MAIL_ADDRESS"}, {0x40000582, "DIRMSG_WRONG_PRODUCT_TYPE"}, {0xC0000583, "DIRLOG_BUILD_SPN_FAILURE"}, {0x40000584, "DIRLOG_DRA_PROPERTY_APPLIED"}, {0x40000585, "DIRLOG_DRA_PROPERTY_NOT_APPLIED"}, {0xC0000586, "DIRLOG_STALE_PHANTOM_CLEANUP_ADD_FAILED"}, {0xC0000587, "DIRLOG_STALE_PHANTOM_CLEANUP_LOCATE_PHANTOMS_FAILED"}, {0xC0000588, "DIRLOG_STALE_PHANTOM_CLEANUP_GC_COMM_FAILED"}, {0xC0000589, "DIRLOG_STALE_PHANTOM_CLEANUP_CANT_USE_INDEX"}, {0xC000058A, "DIRLOG_STALE_PHANTOM_CLEANUP_CANT_MAKE_INDEX"}, {0xC000058B, "DIRLOG_STALE_PHANTOM_CLEANUP_MACHINE_IS_GC"}, {0xC000058C, "DIRLOG_STALE_PHANTOM_CLEANUP_TOO_BUSY"}, {0x4000058D, "DIRLOG_STALE_PHANTOM_CLEANUP_SUCCESS_AS_MASTER"}, {0x4000058E, "DIRLOG_STALE_PHANTOM_CLEANUP_SUCCESS_NOT_AS_MASTER"}, {0x4000058F, "DIRMSG_DOMAIN_SID_EXISTS"}, {0x40000590, "DIRMSG_SYNCING_RID_FSMO"}, {0x80000591, "DIRLOG_FAILED_TO_SYNC_RID_FSMO"}, {0x80000592, "DIRLOG_FAILED_TO_CREATE_BOOT_OPTION"}, {0xC0000593, "DIRLOG_REMOTE_ADD_FAILED"}, {0xC0000594, "DIRLOG_REMOTE_ADD_SUCCEEDED"}, {0xC0000595, "DIRLOG_DUPLICATE_MOVED_OBJECT"}, {0xC0000596, "DIRLOG_CROSS_DOMAIN_MOVE_SUCCEEDED"}, {0xC0000597, "DIRLOG_CROSS_DOMAIN_MOVE_FAILED"}, {0xC0000598, "DIRLOG_CROSS_DOMAIN_MOVE_CLEANUP_REQUIRED"}, {0x40000599, "DIRLOG_CANT_FIND_REG_PARM_DEFAULT"}, {0x4000059A, "DIRLOG_DB_REG_PATH_CHANGED"}, {0x8000059B, "DIRLOG_KCC_DIR_OP_FAILURE"}, {0x8000059C, "DIRLOG_ISM_OBJECT_FAILURE"}, {0x8000059D, "DIRMSG_INSTALL_MISSING_INFO"}, {0x8000059E, "DIRMSG_INSTALL_SPECIAL_NAME"}, {0x8000059F, "DIRLOG_KCC_TRANSPORT_ADDRESS_MISSING"}, {0x400005A0, "DIRMSG_FAILED_TO_CREATE_REMOTE_NTDSA"}, {0x400005A1, "DIRMSG_CREATING_REMOTE_NTDSA"}, {0x400005A2, "DIRLOG_FAILED_TO_REMOVE_NTDSA"}, {0x400005A3, "DIRLOG_FAILED_TO_REMOVE_EXTN_OBJECT"}, {0x400005A4, "DIRLOG_FAILED_TO_CREATE_EXTN_OBJECT"}, {0x400005A5, "DIRLOG_FAILED_TO_FIND_MACHINE_ACCOUNT"}, {0xC00005A6, "DIRLOG_FAILED_TO_CREATE_RESTORE_MARKER_FILE"}, {0xC00005A7, "DIRLOG_FAILED_TO_DELETE_RESTORE_MARKER_FILE"}, {0xC00005A8, "DIRLOG_ISM_SMTP_DSN"}, {0x400005A9, "DIRLOG_SDPROP_NO_CLASS_CACHE"}, {0xC00005AA, "DIRLOG_SDPROP_MERGE_SD_FAIL"}, {0xC00005AB, "DIRLOG_SDPROP_REMOVE_SD_PROBLEM"}, {0xC00005AC, "DIRLOG_SDPROP_ADD_SD_PROBLEM"}, {0x400005AD, "DIRLOG_SDPROP_TOO_BUSY_TO_PROPAGATE"}, {0x400005AE, "DIRMSG_SEARCHING_FOR_SYNC_SERVER"}, {0x400005AF, "DIRMSG_FAILED_TO_FIND_SYNC_SERVER"}, {0x400005B0, "DIRMSG_REPLICATING_OFF_CHANGES"}, {0x400005B1, "DIRMSG_FAILED_TO_REPLICATE_OFF_CHANGES"}, {0x400005B2, "DIRLOG_FSMO_XFER"}, {0x400005B3, "DIRLOG_BEGIN_DIR_FIND"}, {0x400005B4, "DIRLOG_END_DIR_FIND"}, {0x400005B5, "DIRLOG_BEGIN_LDAP_BIND"}, {0x400005B6, "DIRLOG_END_LDAP_BIND"}, {0x800005B7, "DIRLOG_CORRUPT_INDICES_DELETED"}, {0x400005B8, "DIRLOG_SCHEMA_INDEX_NEEDED"}, {0x800005B9, "DIRLOG_ISM_LINK_MONITOR_FAILURE"}, {0xC00005BA, "DIRLOG_ISM_SMTP_DOMAIN_ADD_FAILURE"}, {0xC00005BB, "DIRLOG_ISM_SMTP_SINK_REG_FAILURE"}, {0xC00005BC, "DIRLOG_ISM_SMTP_SINK_BIND_FAILURE"}, {0xC00005BD, "DIRLOG_ISM_SMTP_CLASS_MISSING"}, {0x400005BE, "DIRLOG_ISM_SMTP_DOMAIN_ADD"}, {0x800005BF, "DIRLOG_ISM_SMTP_DROP_DIR_MISSING"}, {0xC00005C0, "DIRLOG_DUPLICATE_SPN_MAPPING_VALUE"}, {0x800005C1, "DIRLOG_ISM_TRANSPORT_CONFIG_FAILURE"}, {0x800005C2, "DIRLOG_KCC_TRANSPORT_BRIDGEHEAD_NOT_FOUND"}, {0x800005C3, "DIRLOG_PERFMON_COUNTER_UNREG_FAILED"}, {0x800005C4, "DIRLOG_PERFMON_COUNTER_REG_FAILED"}, {0x400005C5, "DIRLOG_PERFMON_COUNTER_REG_SUCCESS"}, {0x400005C6, "DIRLOG_DRA_COMPRESSED_OUTBOUND_RPC"}, {0xC00005C7, "DIRLOG_DRA_UPDATE_FAILURE_TOO_LARGE"}, {0xC00005C8, "DIRLOG_DRA_UPDATE_FAILURE_DISK_FULL"}, {0x800005C9, "DIRLOG_DSA_OBJECT_FAILURE"}, {0x400005CA, "DIRLOG_CHK_LINK_DEL_NONC_SUCCESS"}, {0x400005CB, "DIRLOG_CHK_LINK_DEL_NONC_FAILURE"}, {0x400005CC, "DIRMSG_CANNOT_CONTACT_DOMAIN_FSMO"}, {0x400005CD, "DIRLOG_KCC_TASK_ENTRY"}, {0x400005CE, "DIRLOG_KCC_TASK_EXIT"}, {0x400005CF, "DIRLOG_IDL_DRS_REPLICA_SYNC_ENTRY"}, {0x400005D0, "DIRLOG_IDL_DRS_REPLICA_SYNC_EXIT"}, {0x400005D1, "DIRLOG_IDL_DRS_GETCHG_ENTRY"}, {0x400005D2, "DIRLOG_IDL_DRS_GETCHG_EXIT"}, {0x400005D3, "DIRLOG_IDL_DRS_UPDREFS_ENTRY"}, {0x400005D4, "DIRLOG_IDL_DRS_UPDREFS_EXIT"}, {0x400005D5, "DIRLOG_IDL_DRS_REPLICA_ADD_ENTRY"}, {0x400005D6, "DIRLOG_IDL_DRS_REPLICA_ADD_EXIT"}, {0x400005D7, "DIRLOG_IDL_DRS_REPLICA_MODIFY_ENTRY"}, {0x400005D8, "DIRLOG_IDL_DRS_REPLICA_MODIFY_EXIT"}, {0x400005D9, "DIRLOG_IDL_DRS_REPLICA_DEL_ENTRY"}, {0x400005DA, "DIRLOG_IDL_DRS_REPLICA_DEL_EXIT"}, {0x400005DB, "DIRLOG_IDL_DRS_VERIFY_NAMES_ENTRY"}, {0x400005DC, "DIRLOG_IDL_DRS_VERIFY_NAMES_EXIT"}, {0x400005DD, "DIRLOG_IDL_DRS_INTERDOMAIN_MOVE_ENTRY"}, {0x400005DE, "DIRLOG_IDL_DRS_INTERDOMAIN_MOVE_EXIT"}, {0x400005DF, "DIRLOG_IDL_DRS_ADD_ENTRY_ENTRY"}, {0x400005E0, "DIRLOG_IDL_DRS_ADD_ENTRY_EXIT"}, {0x400005E1, "DIRLOG_IDL_DRS_EXECUTE_KCC_ENTRY"}, {0x400005E2, "DIRLOG_IDL_DRS_EXECUTE_KCC_EXIT"}, {0x400005E3, "DIRLOG_IDL_DRS_GET_REPL_INFO_ENTRY"}, {0x400005E4, "DIRLOG_IDL_DRS_GET_REPL_INFO_EXIT"}, {0x400005E5, "DIRLOG_IDL_DRS_GET_NT4_CHGLOG_ENTRY"}, {0x400005E6, "DIRLOG_IDL_DRS_GET_NT4_CHGLOG_EXIT"}, {0x400005E7, "DIRLOG_IDL_DRS_CRACK_NAMES_ENTRY"}, {0x400005E8, "DIRLOG_IDL_DRS_CRACK_NAMES_EXIT"}, {0x400005E9, "DIRLOG_IDL_DRS_WRITE_SPN_ENTRY"}, {0x400005EA, "DIRLOG_IDL_DRS_WRITE_SPN_EXIT"}, {0x400005EB, "DIRLOG_IDL_DRS_DC_INFO_ENTRY"}, {0x400005EC, "DIRLOG_IDL_DRS_DC_INFO_EXIT"}, {0x400005ED, "DIRLOG_IDL_DRS_GET_MEMBERSHIPS_ENTRY"}, {0x400005EE, "DIRLOG_IDL_DRS_GET_MEMBERSHIPS_EXIT"}, {0x800005EF, "DIRLOG_OUT_OF_VERSION_STORE"}, {0x800005F0, "DIRLOG_GC_FAILED_TO_REMOVE_OBJECT"}, {0x800005F1, "DIRLOG_NO_LOCALIZED_INDEX_CREATED_FOR_LANGUAGE"}, {0xC00005F2, "DIRLOG_NO_LOCALIZED_INDICES_CREATED"}, {0xC00005F3, "DIRLOG_SCHEMA_SD_CONVERSION_FAILED"}, {0x400005F4, "DIRLOG_BEGIN_LDAP_REQUEST"}, {0x400005F5, "DIRLOG_END_LDAP_REQUEST"}, {0x400005F6, "DIRLOG_CHK_UPDATED_SCHEDULE"}, {0xC00005F7, "DIRLOG_ISM_SMTP_CDO_CLASS_MISSING"}, {0xC00005F8, "DIRLOG_ISM_SMTP_CDO_ERROR"}, {0x800005F9, "DIRLOG_DRA_MAIL_BADMSGTYPE"}, {0x400005FA, "DIRLOG_DRA_MAIL_RECEIVED"}, {0x800005FB, "DIRLOG_DRA_MAIL_ISM_RECEIVE_RETRY"}, {0x800005FC, "DIRLOG_DRA_MAIL_ISM_SEND_FAILURE"}, {0x400005FD, "DIRLOG_CHK_UPDATED_TRANSPORT_TYPE"}, {0x800005FE, "DIRLOG_DOMAIN_FSMO_AND_NOT_GC"}, {0x400005FF, "DIRLOG_LDAP_EXT_ERROR"}, {0xC0000600, "DIRLOG_SCHEMA_VALIDATION_FAILED"}, {0xC0000601, "DIRLOG_FAILED_TO_DELETE_NEW_DB_GUID_KEY"}, {0x80000602, "DIRLOG_FAILED_TO_CREATE_INVOCATION_ID"}, {0x80000603, "DIRLOG_FAILED_TO_DISABLE_DISK_WRITE_CACHE"}, {0x40000604, "DIRLOG_FAILED_TO_ADD_SID_HISTORY"}, {0x40000605, "DIRLOG_SID_HISTORY_MODIFIED"}, {0x40000606, "DIRLOG_KCC_LIVE_CONNECTION"}, {0x40000607, "DIRLOG_KCC_CONNECTION_REPLICATES_NC"}, {0x40000608, "DIRLOG_KCC_BRIDGEHEAD_CHOSEN"}, {0xC0000609, "DIRLOG_DRA_SCHEMA_INFO_MISMATCH"}, {0xC000060A, "DIRLOG_SCHEMA_ATT_CONFLICT"}, {0xC000060B, "DIRLOG_SCHEMA_CLASS_CONFLICT"}, {0x4000060C, "DIRLOG_DRA_OBJ_NC_MISMATCH"}, {0x4000060D, "DIRLOG_UNUSED_16"}, {0xC000060E, "DIRLOG_CHK_SITE_HAS_NO_NTDS_SETTINGS"}, {0x4000060F, "DIRLOG_DSA_UP_TO_DATE"}, {0x40000610, "DIRLOG_DSA_NOT_ADVERTISE_DC"}, {0x40000611, "DIRLOG_ADUPD_SYNC_PROGRESS"}, {0x40000612, "DIRLOG_ADUPD_SYNC_NO_PROGRESS"}, {0x40000613, "DIRLOG_ADUPD_INIT_SYNC_ONGOING"}, {0x40000614, "DIRLOG_ADUPD_NC_GAVE_UP"}, {0x40000615, "DIRLOG_ADUPD_NC_NEVER_SYNCED_WRITE"}, {0x40000616, "DIRLOG_ADUPD_UNUSED_1"}, {0x40000617, "DIRLOG_ADUPD_GC_NC_MISSING"}, {0x40000618, "DIRLOG_DRA_NEW_REPLICA_FULL_SYNC"}, {0x40000619, "DIRLOG_DRA_USER_REQ_FULL_SYNC"}, {0x4000061A, "DIRLOG_DRA_FULL_SYNC_CONTINUED"}, {0x4000061B, "DIRLOG_DRA_SOURCE_RESTORE_FULL_SYNC"}, {0x4000061C, "DIRLOG_DRA_INIT_SYNCS_DISABLED"}, {0x8000061D, "DIRLOG_GC_PROMOTION_CHECKS_DISABLED"}, {0x8000061E, "DIRLOG_KCC_ALL_TRANSPORT_BRIDGEHEADS_STALE"}, {0xC000061F, "DIRLOG_KCC_EXPLICIT_BRIDGEHEAD_LIST_INCOMPLETE"}, {0xC0000620, "DIRLOG_KCC_NO_BRIDGEHEADS_ENABLED_FOR_TRANSPORT"}, {0x40000621, "DIRMSG_NTDSETUP_CANCELLED"}, {0x40000622, "DIRLOG_ISM_SMTP_DROP_DIRECTORY"}, {0xC0000623, "DIRLOG_UNUSED_15"}, {0x40000624, "DIRLOG_UNUSED_14"}, {0x40000625, "DIRLOG_UNUSED_3"}, {0x80000626, "DIRLOG_DRA_SDP_LOCK_CONTENTION"}, {0x40000627, "DIRLOG_DRA_PARTIAL_ATTR_ADD_FULL_SYNC"}, {0xC0000628, "DIRLOG_INHERIT_SECURITY_IDENTITY_FAILURE"}, {0x40000629, "DIRLOG_INHERIT_SECURITY_IDENTITY_SUCCEEDED"}, {0x4000062A, "DIRLOG_GC_OCCUPANCY_NOT_MET"}, {0x8000062B, "DIRLOG_DRA_MAIL_SEND_CONTENTION"}, {0x4000062C, "DIRLOG_DRA_REPLICATION_FINISHED"}, {0x8000062D, "DIRLOG_DS_DNS_HOST_RESOLUTION_FAILED"}, {0x4000062E, "DIRLOG_SCHEMA_CACHE_UPDATED"}, {0x8000062F, "DIRLOG_DEMOTE_LAST_DC_MISMATCH"}, {0x80000630, "DIRLOG_DEMOTE_NOT_LAST_DC_MISMATCH"}, {0x40000631, "DIRLOG_NT4_REPLICATION_CHECKPOINT_SUCCESSFUL"}, {0x80000632, "DIRLOG_NT4_REPLICATION_CHECKPOINT_UNSUCCESSFUL"}, {0x40000633, "DIRLOG_DRA_ADJUSTED_DEST_BOOKMARKS_AFTER_RESTORE"}, {0x80000634, "DIRLOG_DRA_VALUE_NOT_PROPER_FOR_DELETED"}, {0x40000635, "DIRLOG_RPC_UNUSED_1"}, {0x40000636, "DIRLOG_RPC_UNUSED_2"}, {0x40000637, "DIRLOG_RPC_UNUSED_3"}, {0x40000638, "DIRLOG_RPC_CALL_GETCHG"}, {0x40000639, "DIRLOG_RPC_UNUSED_5"}, {0x4000063A, "DIRLOG_RPC_UNUSED_6"}, {0x4000063B, "DIRLOG_RPC_UNUSED_7"}, {0x4000063C, "DIRLOG_RPC_UNUSED_8"}, {0x4000063D, "DIRLOG_RPC_UNUSED_9"}, {0x4000063E, "DIRLOG_RPC_UNUSED_10"}, {0x4000063F, "DIRLOG_RPC_UNUSED_11"}, {0x40000640, "DIRLOG_RPC_UNUSED_12"}, {0x40000641, "DIRLOG_RPC_UNUSED_13"}, {0x40000642, "DIRLOG_RPC_UNUSED_14"}, {0xC0000643, "DIRLOG_FIXED_INDEX_CREATION_FAILED"}, {0x40000644, "DIRLOG_NSPI_BEGIN_UPDATE_STAT"}, {0x40000645, "DIRLOG_NSPI_END_UPDATE_STAT"}, {0x40000646, "DIRLOG_NSPI_BEGIN_COMPARE_DNT"}, {0x40000647, "DIRLOG_NSPI_END_COMPARE_DNT"}, {0x40000648, "DIRLOG_NSPI_BEGIN_QUERY_ROWS"}, {0x40000649, "DIRLOG_NSPI_END_QUERY_ROWS"}, {0x4000064A, "DIRLOG_NSPI_BEGIN_SEEK_ENTRIES"}, {0x4000064B, "DIRLOG_NSPI_END_SEEK_ENTRIES"}, {0x4000064C, "DIRLOG_NSPI_BEGIN_GET_MATCHES"}, {0x4000064D, "DIRLOG_NSPI_END_GET_MATCHES"}, {0x4000064E, "DIRLOG_NSPI_BEGIN_RESOLVE_NAMES"}, {0x4000064F, "DIRLOG_NSPI_END_RESOLVE_NAMES"}, {0x40000650, "DIRLOG_NSPI_BEGIN_DNT2EPH"}, {0x40000651, "DIRLOG_NSPI_END_DNT2EPH"}, {0x40000652, "DIRLOG_NSPI_BEGIN_HIERARCHY_INFO"}, {0x40000653, "DIRLOG_NSPI_END_HIERARCHY_INFO"}, {0x40000654, "DIRLOG_NSPI_BEGIN_RESORT_RESTRICTION"}, {0x40000655, "DIRLOG_NSPI_END_RESORT_RESTRICTION"}, {0x40000656, "DIRLOG_NSPI_BEGIN_BIND"}, {0x40000657, "DIRLOG_NSPI_END_BIND"}, {0x40000658, "DIRLOG_NSPI_BEGIN_NAME_FROM_ID"}, {0x40000659, "DIRLOG_NSPI_END_NAME_FROM_ID"}, {0x4000065A, "DIRLOG_NSPI_BEGIN_ID_FROM_NAME"}, {0x4000065B, "DIRLOG_NSPI_END_ID_FROM_NAME"}, {0x4000065C, "DIRLOG_NSPI_BEGIN_GET_PROP_LIST"}, {0x4000065D, "DIRLOG_NSPI_END_GET_PROP_LIST"}, {0x4000065E, "DIRLOG_NSPI_BEGIN_QUERY_COLUMNS"}, {0x4000065F, "DIRLOG_NSPI_END_QUERY_COLUMNS"}, {0x40000660, "DIRLOG_NSPI_BEGIN_GET_PROPS"}, {0x40000661, "DIRLOG_NSPI_END_GET_PROPS"}, {0x40000662, "DIRLOG_NSPI_BEGIN_GET_TEMPLATE_INFO"}, {0x40000663, "DIRLOG_NSPI_END_GET_TEMPLATE_INFO"}, {0x40000664, "DIRLOG_NSPI_BEGIN_MOD_PROPS"}, {0x40000665, "DIRLOG_NSPI_END_MOD_PROPS"}, {0x40000666, "DIRLOG_NSPI_BEGIN_MOD_LINKATT"}, {0x40000667, "DIRLOG_NSPI_END_MOD_LINKATT"}, {0x40000668, "DIRLOG_NSPI_BEGIN_DELETE_ENTRIES"}, {0x40000669, "DIRLOG_NSPI_END_DELETE_ENTRIES"}, {0xC000066A, "DIRLOG_DRA_CERT_ACCESS_DENIED_NOT_DC"}, {0x4000066B, "DIRLOG_SEARCH_OPERATIONS"}, {0x4000066C, "DIRLOG_SEARCH_FILTER_LOGGING"}, {0xC000066D, "DIRLOG_DRA_SPN_WRONG_TARGET_NAME"}, {0x4000066E, "DIRLOG_DB_FREE_SPACE"}, {0x8000066F, "DIRLOG_DRA_SCHEMA_INFO_WRITE_FAILED"}, {0x80000670, "DIRLOG_SDPROP_BAD_DELETED_SD"}, {0x40000671, "DIRLOG_PAO_ADD_REPLICA"}, {0x40000672, "DIRLOG_PAO_DELETE_REPLICA"}, {0x40000673, "DIRLOG_PAO_SYNCHRONIZE_REPLICA"}, {0x40000674, "DIRLOG_PAO_UPDATE_REFERENCES"}, {0x40000675, "DIRLOG_PAO_MODIFY_REPLICA"}, {0x80000676, "DIRLOG_ISM_LDAP_EXT_SEARCH_RESULT"}, {0x80000677, "DIRLOG_GC_INVALIDATED"}, {0xC0000678, "DIRLOG_NO_RPC_PROTSEQS"}, {0x80000679, "DIRLOG_ISM_ADS_GET_OBJECT_FAILURE"}, {0x4000067A, "DIRLOG_DRA_NC_TEARDOWN_BEGIN"}, {0x4000067B, "DIRLOG_DRA_NC_TEARDOWN_RESUME"}, {0x4000067C, "DIRLOG_DRA_NC_TEARDOWN_SUCCESS"}, {0x4000067D, "DIRLOG_DRA_NC_TEARDOWN_FAILURE"}, {0xC000067E, "DIRLOG_MAPI_TABLE_TOO_BIG"}, {0x8000067F, "DIRLOG_KCC_CACHE_INIT_FAILED"}, {0xC0000680, "DIRLOG_KCC_CONNECTION_OBJ_TRANSLATION_DISABLED"}, {0x40000681, "DIRLOG_IDL_DRS_GET_MEMBERSHIPS2_ENTRY"}, {0x40000682, "DIRLOG_IDL_DRS_GET_MEMBERSHIPS2_EXIT"}, {0x80000683, "DIRLOG_GROUP_CACHING_CONFIGURED_SITE_NOT_CLOSEST"}, {0x80000684, "DIRLOG_GROUP_CACHING_CLOSER_GC_FOUND"}, {0x80000685, "DIRLOG_GROUP_CACHING_MAX_USERS_REFRESHED"}, {0x80000686, "DIRLOG_GROUP_CACHING_FALLING_BEHIND"}, {0x80000687, "DIRLOG_GROUP_CACHING_CANT_FIND_OPEN_SLOT"}, {0x80000688, "DIRLOG_GROUP_CACHING_NO_SCHEDULE_FOR_PREFERRED_SITE"}, {0x40000689, "DIRLOG_LVR_SET_META_INSERT_MADE_PRESENT"}, {0x4000068A, "DIRLOG_LVR_SET_META_INSERT_PRESENT"}, {0x4000068B, "DIRLOG_LVR_SET_META_REPLACE_MADE_ABSENT"}, {0x4000068C, "DIRLOG_LVR_SET_META_REPLACE_TOUCHED"}, {0x4000068D, "DIRLOG_LVR_SET_META_REMOVE_ATT_MADE_ABSENT"}, {0x4000068E, "DIRLOG_LVR_SET_META_REMOVE_VALUE_MADE_ABSENT"}, {0x4000068F, "DIRLOG_LVR_META_INFO"}, {0x40000690, "DIRLOG_LVR_FILTERED_NOT_PAS"}, {0x40000691, "DIRLOG_LVR_FILTERED_NOT_GROUP"}, {0x40000692, "DIRLOG_LVR_FILTERED_NOT_NEEDED"}, {0x40000693, "DIRLOG_LVR_SHIPPED"}, {0x40000694, "DIRLOG_LVR_NOT_APPLIED_DELETED"}, {0x40000695, "DIRLOG_LVR_NOT_APPLIED_MISSING"}, {0x40000696, "DIRLOG_LVR_NOT_APPLIED_NOT_NEEDED"}, {0x40000697, "DIRLOG_LVR_GET_META_OP"}, {0x40000698, "DIRLOG_LVR_REMOTE_META_INFO"}, {0x40000699, "DIRLOG_LVR_APPLIED"}, {0x4000069A, "DIRLOG_LVR_CONFLICT"}, {0x4000069B, "DIRLOG_LVR_NOT_APPLIED_VALUE_DELETED"}, {0x4000069C, "DIRLOG_LVR_NOT_APPLIED_MISSING2"}, {0x4000069D, "DIRLOG_LVR_SET_META_INSERT_ABSENT"}, {0xC000069E, "DIRLOG_DRA_UPDATE_VALUE_FAILURE_NOT_BUSY"}, {0x4000069F, "DIRLOG_LVR_ENABLED"}, {0x400006A0, "DIRMSG_INSTALL_REPLICATE_PROGRESS_VALUES"}, {0x400006A1, "DIRLOG_GC_REMOVED_OBJECT_VALUE"}, {0x800006A2, "DIRLOG_GC_FAILED_TO_REMOVE_OBJECT_VALUE"}, {0xC00006A3, "DIRLOG_DRA_GETCHANGES_FAILED"}, {0xC00006A4, "DIRLOG_MAIL_INTERSITE_TRANSPORT_MISSING"}, {0xC00006A5, "DIRLOG_MAIL_ADD_SCHEMA_INFO_FAILED"}, {0x400006A6, "DIRLOG_GC_PAS_COMPLETED"}, {0x400006A7, "DIRLOG_GC_TRIGGER_FULL_SYNC"}, {0x400006A8, "DIRLOG_GC_PAS_CYCLE"}, {0x400006A9, "DIRLOG_GC_FOUND_INVALID_PAS_SOURCE"}, {0x400006AA, "DIRLOG_GC_FOUND_PAS_SOURCE"}, {0x400006AB, "DIRLOG_GC_PAS_SOURCE_NOT_FOUND"}, {0x400006AC, "DIRLOG_GC_REGISTER_ACTIVE_PAS"}, {0x400006AD, "DIRLOG_GC_REGISTER_RESET_PAS"}, {0x800006AE, "DIRLOG_GC_NO_SOURCES"}, {0x400006AF, "DIRLOG_GC_SKIP_ENQUEUE"}, {0x400006B0, "DIRLOG_GC_ABANDON_PAS"}, {0x400006B1, "DIRLOG_SEARCH_VLV_INDEX_NOT_FOUND"}, {0x400006B2, "DIRLOG_LVR_SET_META_GROUP_TYPE_CHANGE"}, {0x800006B3, "DIRLOG_LINK_CLEAN_END_ABNORMAL"}, {0x400006B4, "DIRLOG_GC_UPDATED_OBJECT_VALUE"}, {0xC00006B5, "DIRMSG_INSTALL_FAILED_VERSION_CHECK"}, {0xC00006B6, "DIRLOG_FAILED_VERSION_CHECK"}, {0xC00006B7, "DIRLOG_UNABLE_TO_CHECK_VERSION"}, {0xC00006B8, "DIRLOG_HIGHER_DSA_VERSION"}, {0xC00006B9, "DIRLOG_UNABLE_TO_UPDATE_VERSION"}, {0x400006BA, "DIRLOG_DSA_VERSION_UPDATED"}, {0x800006BB, "DIRLOG_LOWER_DSA_VERSION"}, {0x800006BC, "DIRLOG_NO_VERSION_UPGRADE_IN_MIXED_DOMAIN"}, {0x800006BD, "DIRLOG_DRA_TOO_LOW_VERSION"}, {0xC00006BE, "DIRLOG_BAD_VERSION_REP_IN"}, {0xC00006BF, "DIRLOG_DS_TOO_OLD"}, {0xC00006C0, "DIRLOG_FAILED_BOOT_OPTION_SETUP"}, {0xC00006C1, "DIRMSG_INSTALL_FAILED_TOMBSTONE_CHECK"}, {0x400006C2, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_RMSOURCE_SUCCESS"}, {0x400006C3, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_RMSOURCE_FAILURE"}, {0x400006C4, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_TEARDOWN_SUCCESS"}, {0x400006C5, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_TEARDOWN_FAILURE"}, {0x400006C6, "DIRLOG_CHK_LINK_DEL_HAVE_READONLY_NEED_WRITEABLE_RMSOURCE_SUCCESS"}, {0x400006C7, "DIRLOG_CHK_LINK_DEL_HAVE_READONLY_NEED_WRITEABLE_RMSOURCE_FAILURE"}, {0x400006C8, "DIRLOG_CHK_LINK_DEL_HAVE_READONLY_NEED_WRITEABLE_TEARDOWN_SUCCESS"}, {0x400006C9, "DIRLOG_CHK_LINK_DEL_HAVE_READONLY_NEED_WRITEABLE_TEARDOWN_FAILURE"}, {0x400006CA, "DIRLOG_CHK_LINK_DEL_HAVE_WRITEABLE_NEED_READONLY_RMSOURCE_SUCCESS"}, {0x400006CB, "DIRLOG_CHK_LINK_DEL_HAVE_WRITEABLE_NEED_READONLY_RMSOURCE_FAILURE"}, {0x400006CC, "DIRLOG_CHK_LINK_DEL_HAVE_WRITEABLE_NEED_READONLY_TEARDOWN_SUCCESS"}, {0x400006CD, "DIRLOG_CHK_LINK_DEL_HAVE_WRITEABLE_NEED_READONLY_TEARDOWN_FAILURE"}, {0x400006CE, "DIRLOG_CHK_LINK_DEL_SOURCE_READONLY_SUCCESS"}, {0x400006CF, "DIRLOG_CHK_LINK_DEL_SOURCE_READONLY_FAILURE"}, {0x400006D0, "DIRLOG_CHK_LINK_DEL_NOTGC_TEARDOWN_SUCCESS"}, {0x400006D1, "DIRLOG_CHK_LINK_DEL_NOTGC_TEARDOWN_FAILURE"}, {0x400006D2, "DIRLOG_CHK_LINK_DEL_DOMDEL_TEARDOWN_SUCCESS"}, {0x400006D3, "DIRLOG_CHK_LINK_DEL_DOMDEL_TEARDOWN_FAILURE"}, {0x800006D4, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_TEARDOWN_NOREPLICACFG"}, {0x800006D5, "DIRLOG_CHK_LINK_DEL_NDNC_NOTREPLICA_TEARDOWN_NOREPLICAADVERTISING"}, {0x400006D6, "DIRLOG_CHK_LINK_DEL_NDNC_NOCROSSREF_TEARDOWN_SUCCESS"}, {0x400006D7, "DIRLOG_CHK_LINK_DEL_NDNC_NOCROSSREF_TEARDOWN_FAILURE"}, {0x400006D8, "DIRLOG_CHK_LINK_DEL_NDNC_NOCROSSREF_RMSOURCE_SUCCESS"}, {0x400006D9, "DIRLOG_CHK_LINK_DEL_NDNC_NOCROSSREF_RMSOURCE_FAILURE"}, {0x400006DA, "DIRLOG_CHK_LINK_DEL_READONLY_NOTGCHOSTED_RMSOURCE_SUCCESS"}, {0x400006DB, "DIRLOG_CHK_LINK_DEL_READONLY_NOTGCHOSTED_RMSOURCE_FAILURE"}, {0x400006DC, "DIRLOG_CHK_LINK_DEL_READONLY_NOTGCHOSTED_TEARDOWN_SUCCESS"}, {0x400006DD, "DIRLOG_CHK_LINK_DEL_READONLY_NOTGCHOSTED_TEARDOWN_FAILURE"}, {0x400006DE, "DIRMSG_DEMOTE_NC_GIVING_AWAY_FSMO_ROLES"}, {0x400006DF, "DIRMSG_DEMOTE_NC_COMPLETING_LINK_CLEANUP"}, {0x400006E0, "DIRMSG_DEMOTE_NC_REPLICATING_OFF_CHANGES"}, {0x400006E1, "DIRMSG_DEMOTE_NC_GETTING_TARGET"}, {0x400006E2, "DIRMSG_DEMOTE_NC_BEGIN"}, {0x400006E3, "DIRMSG_DEMOTE_NC_FAILED"}, {0x400006E4, "DIRMSG_DEMOTE_NC_SUCCESS"}, {0x400006E5, "DIRMSG_DEMOTE_NC_NO_TARGETS"}, {0x400006E6, "DIRLOG_LOCALIZED_CREATE_INDEX_FAILED"}, {0xC00006E7, "DIRMSG_SPACE_IN_NETBIOSNAME"}, {0xC00006E8, "DIRLOG_KCC_SITE_LINK_SITE_NOT_IN_SITE_LIST"}, {0xC00006E9, "DIRLOG_NDNC_NO_REFERENCE_DOMAIN_SET"}, {0xC00006EA, "DIRLOG_UNUSED_4"}, {0xC00006EB, "DIRLOG_KCC_BRIDGE_SITE_LINK_NOT_IN_SITE_LINK_LIST"}, {0x800006EC, "DIRLOG_HEAP_CREATE_FAILED"}, {0xC00006ED, "DIRLOG_FAILED_BOOT_OPTION_SETUP_DISK"}, {0xC00006EE, "DIRLOG_AUTO_LINK_ID_FAILED"}, {0x800006EF, "DIRLOG_LDAP_DIGEST_WARNING"}, {0x400006F0, "DIRLOG_GROUP_CACHING_TASK_STARTING"}, {0x400006F1, "DIRLOG_GROUP_CACHING_TASK_ENDING"}, {0x400006F2, "DIRLOG_GROUP_CACHING_TASK_RESCHEDULING"}, {0x400006F3, "DIRLOG_GROUP_CACHING_GC_FOUND"}, {0x400006F4, "DIRLOG_GROUP_CACHING_NO_GC_FOUND"}, {0x400006F5, "DIRLOG_GROUP_CACHING_SITE_FOUND"}, {0x400006F6, "DIRLOG_GROUP_CACHING_NO_SITE_FOUND"}, {0x400006F7, "DIRLOG_GROUP_CACHING_GROUP_RETRIEVAL_FAILED"}, {0x400006F8, "DIRLOG_GROUP_CACHING_GROUP_NO_GC_SITE"}, {0x400006F9, "DIRLOG_GROUP_CACHING_NO_SCHEDULE_FOR_SITE"}, {0x800006FA, "DIRLOG_KCC_SITE_LINK_TOO_SMALL"}, {0xC00006FB, "DIRLOG_KCC_SITE_LINK_BRIDGE_TOO_SMALL"}, {0xC00006FC, "DIRLOG_KCC_NONINTERSECTING_SCHEDULES"}, {0xC00006FD, "DIRLOG_KCC_SITE_WITH_NO_LINKS"}, {0xC00006FE, "DIRLOG_GC_PROMOTION_FAILED"}, {0xC00006FF, "DIRLOG_REPLICATION_SKIP_REQUEUE"}, {0x80000700, "DIRLOG_OVERLONG_TRANSACTION"}, {0x40000701, "DIRLOG_TASK_QUEUE_BEGIN_EXECUTE"}, {0x40000702, "DIRLOG_TASK_QUEUE_END_EXECUTE"}, {0x80000703, "DIRLOG_KCC_UNKNOWN_TRANSPORT"}, {0x80000704, "DIRLOG_KCC_SET_PRIORITY_ERROR"}, {0x80000705, "DIRLOG_KCC_ALMOST_MADE_DUP_CONNECTION"}, {0xC0000706, "DIRMSG_FAIL_GET_GUID_REPLSERVER"}, {0x80000707, "DIRLOG_KCC_DESTINATION_DSA_NOT_FOUND"}, {0x80000708, "DIRLOG_KCC_NO_WRITEABLE_SOURCE_FOR_GC_TOPOLOGY"}, {0x80000709, "DIRLOG_KCC_NC_NOT_INSTANTIATED_ANYWHERE"}, {0x4000070A, "DIRLOG_KCC_NC_HEAD_NOT_FOUND"}, {0x8000070B, "DIRLOG_CHK_BAD_ISM_SCHEDULE"}, {0x4000070C, "DIRMSG_DEMOTE_NC_GIVING_AWAY_FSMO_ROLES_COMPELETE"}, {0x4000070D, "DIRMSG_DEMOTE_NC_REPLICATING_OFF_CHANGES_COMPELETE"}, {0x4000070E, "DISMSG_INSTALL_SCHEMA_COMPELETE"}, {0x4000070F, "DISMSG_INSTALL_CONFIGURATION_COMPELETE"}, {0x40000710, "DISMSG_INSTALL_CRITICAL_COMPELETE"}, {0x40000711, "DIRLOG_GC_NO_INTRA_SITE_SOURCES"}, {0xC0000712, "DIRLOG_ISM_WAIT_FOR_OBJECTS_FAILED"}, {0xC0000713, "DIRLOG_ISM_START_SERVICE_CTRL_DISPATCHER_FAILURE"}, {0xC0000714, "DIRLOG_ISM_INIT_SERVICE"}, {0xC0000715, "DIRLOG_ISM_CREATE_EVENT_FAILED"}, {0xC0000716, "DIRLOG_ISM_DS_BAD_NAME_SYNTAX"}, {0xC0000717, "DIRLOG_ISM_NOT_ENOUGH_MEMORY"}, {0xC0000718, "DIRLOG_ISM_REGISTER_SERVICE_CONTROL_HANDLER_FAILED"}, {0xC0000719, "DIRLOG_ISM_START_RPC_SERVER_FAILED"}, {0xC000071A, "DIRLOG_ISM_CONSTRUCT_SECURITY_DESCRIPTOR_FAILED"}, {0xC000071B, "DIRLOG_ISM_RPC_SERVER_USE_PROT_SEQ_FAILED"}, {0xC000071C, "DIRLOG_ISM_RPC_SERVER_REGISTER_IF_FAILED"}, {0xC000071D, "DIRLOG_ISM_RPC_SERVER_LISTEN_FAILED"}, {0x8000071E, "DIRLOG_ISM_RPC_SERVER_STOP_FAILED"}, {0xC000071F, "DIRLOG_ISM_LDAP_ABANDON_FAILED"}, {0xC0000720, "DIRLOG_ISM_LDAP_BIND_FAILED"}, {0xC0000721, "DIRLOG_ISM_TRANSPORT_MONITOR_START_FAILURE"}, {0x80000722, "DIRLOG_ISM_CRITICAL_SITE_ATTRIBUTE_FAILURE"}, {0x80000723, "DIRLOG_ISM_CRITICAL_TRANSPORT_ATTRIBUTE_FAILURE"}, {0x80000724, "DIRLOG_KCC_SKIPPED_DIRREPLICAADD"}, {0xC0000725, "DIRMSG_INSTALL_FAILED_TOO_MANY_STANDARD_SERVERS"}, {0xC0000726, "DIRMSG_INSTALL_FAILED_NO_VER"}, {0xC0000727, "DIRMSG_INSTALL_FAILED_IMPROPERLY_DELETED_DOMAIN_FSMO"}, {0xC0000728, "DIRLOG_ISM_NO_SMTP_DOMAIN"}, {0x80000729, "DIRLOG_ISM_ADS_DELETE_OBJECT_FAILURE"}, {0xC000072A, "DIRLOG_ISM_SMTP_DOMAIN_REMOVE_FAILURE"}, {0x8000072B, "DIRLOG_ISM_ADS_SET_INFO_FAILURE"}, {0x4000072C, "DIRLOG_ISM_SMTP_MESSAGE_COUNT"}, {0x4000072D, "DIRLOG_FSMO_XFER_FAILURE"}, {0x8000072E, "DIRLOG_DRA_REPLICATION_OP_OVER_TIME_LIMIT"}, {0x8000072F, "DIRLOG_DRA_REPLICATION_OP_NOT_EXECUTING"}, {0x40000730, "DIRLOG_SCHEMA_DELETED_TUPLE_INDEX"}, {0x40000731, "DIRLOG_SCHEMA_DELETE_TUPLE_INDEX_FAIL"}, {0x40000732, "DIRLOG_GROUP_CACHING_PREFERRED_SITE_LINK"}, {0x40000733, "DIRLOG_DRA_OBJECT_REVIVED"}, {0xC0000734, "DIRLOG_VERIFY_BY_CRACK_ERROR"}, {0x80000735, "DIRLOG_SCHEMA_DUP_GOVERNSID"}, {0x40000736, "DIRLOG_SCHEMA_IGNORE_DEFUNCT"}, {0x80000737, "DIRLOG_SCHEMA_DUP_GOVERNSID_ATTRIBUTEID"}, {0x80000738, "DIRLOG_SCHEMA_DUP_SCHEMAIDGUID_CLASS"}, {0x80000739, "DIRLOG_SCHEMA_DUP_LDAPDISPLAYNAME_CLASS_CLASS"}, {0x8000073A, "DIRLOG_SCHEMA_DUP_LDAPDISPLAYNAME_CLASS_ATTRIBUTE"}, {0x8000073B, "DIRLOG_SCHEMA_DUP_ATTRIBUTEID"}, {0x8000073C, "DIRLOG_SCHEMA_DUP_SCHEMAIDGUID_ATTRIBUTE"}, {0x8000073D, "DIRLOG_SCHEMA_DUP_MAPIID"}, {0x8000073E, "DIRLOG_SCHEMA_DUP_LDAPDISPLAYNAME_ATTRIBUTE"}, {0x4000073F, "DIRLOG_SCHEMA_RESURRECT_RDNATTID"}, {0x40000740, "DIRLOG_UNUSED_13"}, {0x40000741, "DIRMSG_INSTALL_FAILED_SCHEMA_RELOAD"}, {0x40000742, "DISMSG_RELOAD_SCHEMA_COMPELETE"}, {0x80000743, "DIRLOG_GC_CONFIG_PERIOD_TOOLONG"}, {0x40000744, "DIRLOG_DRA_SET_IT"}, {0xC0000745, "DIRLOG_ISM_RPC_SERVER_REGISTER_AUTH_INFO_FAILED"}, {0x80000746, "DIRLOG_DRA_REPLICATION_LATENCY_WARNINGS"}, {0xC0000747, "DIRLOG_DRA_REPLICATION_LATENCY_ERRORS"}, {0xC0000748, "DIRLOG_DRA_REPLICATION_LATENCY_ERRORS_FULL"}, {0x80000749, "DIRLOG_KCC_DISCONNECTED_SITE"}, {0xC000074A, "DIRLOG_ISM_LDAP_EXTENDED_SERVER_ERROR"}, {0x8000074B, "DIRLOG_ISM_LINK_MONITOR_FAILURE_RESTART"}, {0x4000074C, "DIRLOG_OFFSITE_GC_FAILBACK"}, {0x4000074D, "DIRLOG_GC_FOUND"}, {0x8000074E, "DIRLOG_KCC_TOO_MANY_PARTNERS"}, {0xC000074F, "DIRLOG_DRA_ORPHAN_MOVE_FAILURE"}, {0x40000750, "DIRLOG_DRA_ORPHAN_MOVE_SUCCESS"}, {0x40000751, "DIRMSG_COPY_RESTORED_FILES"}, {0xC0000752, "DIRMSG_COPY_RESTORED_FILES_FAILURE"}, {0x80000753, "DIRLOG_DRA_REPL_EPOCH_CHANGED"}, {0x80000754, "DIRLOG_REPL_EPOCH_MISMATCH_COMMUNICATION_REJECTED"}, {0xC0000755, "DIRLOG_DOMAIN_RENAME_ACCESS_DENIED"}, {0xC0000756, "DIRLOG_DOMAIN_RENAME_CANNOT_PROCEED"}, {0xC0000757, "DIRLOG_DOMAIN_RENAME_READ_SCRIPT_FAILED"}, {0xC0000758, "DIRLOG_DOMAIN_RENAME_EXECUTE_SCRIPT_FAILED"}, {0xC0000759, "DIRLOG_DOMAIN_RENAME_CANNOT_SET_NEW_DOMAIN_NAME"}, {0x4000075A, "DIRLOG_DS_SHUTDOWN_DOMAIN_RENAME"}, {0xC000075B, "DIRLOG_DS_SHUTDOWN_DOMAIN_RENAME_FORCE"}, {0x4000075C, "DIRLOG_SCRIPT_OPERATION_INSTANTIATED"}, {0x4000075D, "DIRLOG_SCRIPT_OPERATION_CARDINALITY"}, {0x4000075E, "DIRLOG_SCRIPT_OPERATION_COMPARE"}, {0x4000075F, "DIRLOG_SCRIPT_OPERATION_UPDATE"}, {0x40000760, "DIRLOG_SCRIPT_OPERATION_MOVE"}, {0x40000761, "DIRLOG_SCRIPT_OPERATION_CREATE"}, {0xC0000762, "DIRLOG_DRA_NCNAME_CONFLICT_RENAME_FAILURE"}, {0x40000763, "DIRLOG_DRA_NCNAME_CONFLICT_RENAME_SUCCESS"}, {0xC0000764, "DIRLOG_DSA_CHILD_CLEANUP_FAILURE"}, {0xC0000765, "DIRMSG_REPLICATION_EPOCH_NOT_RETRIEVED"}, {0xC0000766, "DIRMSG_REPLICATION_EPOCH_NOT_MATCHED"}, {0x40000767, "DIRLOG_SCHEMA_ATTRIBUTE_WON_OID"}, {0x40000768, "DIRLOG_SCHEMA_ATTRIBUTE_WON_LDN"}, {0x40000769, "DIRLOG_SCHEMA_ATTRIBUTE_WON_MAPIID"}, {0x4000076A, "DIRLOG_DSA_SCHEMA_OBJECT_MODIFIED"}, {0x4000076B, "DIRLOG_DSA_SCHEMA_OBJECT_ADDED"}, {0xC000076C, "DIRLOG_DUPLICATE_MOVED_OBJECT_CLEANUP"}, {0x8000076D, "DIRLOG_DEMOTE_REMOVE_CA_ERROR"}, {0x4000076E, "DIRLOG_KCC_WHISTLER_ELECTION_ALG"}, {0x4000076F, "DIRLOG_CHK_LINK_ADD_MASTER_SUCCESS"}, {0x40000770, "DIRLOG_KCC_WHISTLER_TOPOLOGY_ALG"}, {0x40000771, "DIRLOG_KCC_SITE_GENERATOR_NOT_VIABLE"}, {0x40000772, "DIRLOG_KCC_SITE_GENERATOR_NO_UTD"}, {0x40000773, "DIRLOG_KCC_SITE_GENERATOR_CLAIM_VALID"}, {0x40000774, "DIRLOG_KCC_SITE_GENERATOR_CLAIM_EXPIRED"}, {0x40000775, "DIRLOG_KCC_ISTG_FAIL_OVER"}, {0xC0000776, "DIRLOG_KCC_UTD_VEC_WRONG_VERSION"}, {0x80000777, "DIRLOG_KCC_INTRASITE_UNAVAILABLE"}, {0xC0000778, "DIRLOG_BACKUP_JET_WRITER_INIT_FAILURE"}, {0xC0000779, "DIRLOG_BACKUP_UNEXPECTED_WIN32_ERROR"}, {0xC000077A, "DIRLOG_BACKUP_NO_NTDS_NO_BACKUP"}, {0xC000077B, "DIRLOG_BACKUP_YES_NTDS_NO_RESTORE"}, {0xC000077C, "DIRLOG_BACKUP_SNAPSHOT_FAILURE"}, {0x4000077D, "DIRLOG_BACKUP_SNAPSHOT_SUCCESS"}, {0xC000077E, "DIRLOG_BACKUP_SNAPSHOT_TOO_OLD"}, {0xC000077F, "DIRLOG_BACKUP_SNAPSHOT_RESTORE_FAILURE"}, {0x40000780, "DIRLOG_BACKUP_SNAPSHOT_RESTORE_SUCCESS"}, {0x80000781, "DIRLOG_BACKUP_DIR_READ_FAILURE"}, {0x80000782, "DIRLOG_SETUP_MACHINE_ACCOUNT_NOT_REVERTED"}, {0x80000783, "DIRMSG_SETUP_MACHINE_ACCOUNT_NOT_MORPHED"}, {0x40000784, "DIRLOG_CHK_LINK_ADD_REPLICA_SUCCESS"}, {0x80000785, "DIRLOG_CHK_LINK_ADD_MASTER_FAILURE"}, {0x80000786, "DIRLOG_CHK_LINK_ADD_REPLICA_FAILURE"}, {0x40000787, "DIRLOG_ADUPD_NC_SYNC_PROGRESS"}, {0x40000788, "DIRLOG_ADUPD_NC_SYNC_NO_PROGRESS"}, {0x40000789, "DIRLOG_RPC_MESSAGE"}, {0x4000078A, "DIRLOG_ADUPD_INIT_SYNC_ONGOING_READONLY"}, {0xC000078B, "DIRLOG_BACKUP_SNAPSHOT_PRERESTORE_FAILURE"}, {0x4000078C, "DIRLOG_DEL_SUB_FROM_NC"}, {0x4000078D, "DIRLOG_ADD_SUB_TO_NC"}, {0x4000078E, "DIRLOG_DEL_AUTO_SUBREF"}, {0x4000078F, "DIRLOG_ADD_AUTO_SUBREF"}, {0x40000790, "DIRLOG_SCRIPT_EXECUTE_STATUS"}, {0x80000791, "DIRLOG_LOR_BEGIN"}, {0x40000792, "DIRLOG_LOR_BEGIN_ADVISORY"}, {0x80000793, "DIRLOG_LOR_END_SUCCESS"}, {0x40000794, "DIRLOG_LOR_SUCCESS_TRANSACTION"}, {0x40000795, "DIRLOG_LOR_FAILURE_TRANSACTION"}, {0x40000796, "DIRLOG_LOR_END_ADVISORY_SUCCESS"}, {0xC0000797, "DIRLOG_LOR_END_FAILURE"}, {0xC0000798, "DIRLOG_LOR_END_ADVISORY_FAILURE"}, {0x80000799, "DIRLOG_LOR_OBJECT_DELETION"}, {0x4000079A, "DIRLOG_LOR_OBJECT_DELETION_ADVISORY"}, {0xC000079B, "DIRLOG_LOR_OBJECT_DELETION_FAILED"}, {0xC000079C, "DIRLOG_LOR_OBJECT_DELETION_FAILED_CRITICAL_OBJECT"}, {0xC000079D, "DIRLOG_LOR_OBJECT_DELETION_ERROR"}, {0xC000079E, "DIRLOG_LOR_OBJECT_DELETION_ERROR_FATAL"}, {0x4000079F, "DIRLOG_REF_CACHE_REBUILD_FAILURE"}, {0x400007A0, "DIRLOG_KCC_CONN_ON_PROBATION"}, {0xC0002710, "DIRMSG_DB_success"}, {0xC0002711, "DIRMSG_DB_ERR_UNKNOWN_ERROR"}, {0xC0002712, "DIRMSG_DB_ERR_NO_CHILD"}, {0xC0002713, "DIRMSG_DB_ERR_NEXTCHILD_NOTFOUND"}, {0xC0002714, "DIRMSG_DB_ERR_CANT_SORT"}, {0xC0002715, "DIRMSG_DB_ERR_TIMELIMIT"}, {0xC0002716, "DIRMSG_DB_ERR_NO_VALUE"}, {0xC0002717, "DIRMSG_DB_ERR_BUFFER_INADEQUATE"}, {0xC0002718, "DIRMSG_DB_ERR_UNUSED_1"}, {0xC0002719, "DIRMSG_DB_ERR_VALUE_TRUNCATED"}, {0xC000271A, "DIRMSG_DB_ERR_ATTRIBUTE_EXISTS"}, {0xC000271B, "DIRMSG_DB_ERR_ATTRIBUTE_DOESNT_EXIST"}, {0xC000271C, "DIRMSG_DB_ERR_VALUE_EXISTS"}, {0xC000271D, "DIRMSG_DB_ERR_SYNTAX_CONVERSION_FAILED"}, {0xC000271E, "DIRMSG_DB_ERR_NOT_ON_BACKLINK"}, {0xC000271F, "DIRMSG_DB_ERR_VALUE_DOESNT_EXIST"}, {0xC0002720, "DIRMSG_DB_ERR_NO_PROPAGATIONS"}, {0xC0002721, "DIRMSG_DB_ERR_DATABASE_ERROR"}, {0xC0002722, "DIRMSG_DB_ERR_CANT_ADD_DEL_KEY"}, {0xC0002723, "DIRMSG_DB_ERR_DSNAME_LOOKUP_FAILED"}, {0xC0002724, "DIRMSG_DB_ERR_NO_MORE_DEL_RECORD"}, {0xC0002725, "DIRMSG_DB_ERR_NO_SORT_TABLE"}, {0xC0002726, "DIRMSG_DB_ERR_NOT_OPTIMIZABLE"}, {0xC0002727, "DIRMSG_DB_ERR_BAD_INDEX"}, {0xC0002728, "DIRMSG_DB_ERR_UNUSED_2"}, {0xC0002729, "DIRMSG_DB_ERR_TOO_MANY"}, {0xC000272A, "DIRMSG_DB_ERR_SYSERROR"}, {0xC000272B, "DIRMSG_DB_ERR_BAD_SYNTAX"}, {0xC000272C, "DIRMSG_DB_ERR_UNUSED_3"}, {0xC000272D, "DIRMSG_DB_ERR_NOT_ON_CORRECT_VALUE"}, {0xC000272E, "DIRMSG_DB_ERR_ONLY_ON_LINKED_ATTRIBUTE"}, {0xC000272F, "DIRMSG_DB_ERR_EXCEPTION"}, {0xC0002730, "DIRMSG_DB_ERR_SHUTTING_DOWN"}, {0xC0002731, "DIRMSG_DB_ERR_WRITE_CONFLICT"}, {0xC0002732, "DIRMSG_DB_ERR_VLV_CONTROL"}, {0xC0002733, "DIRMSG_DB_ERR_NOT_AN_OBJECT"}, {0xC0002734, "DIRLOG_DB_ERR_ALREADY_INSERTED"}, {0xC0002735, "DIRLOG_DB_ERR_NO_CURRENT_RECORD"}, {0xC0002736, "DIRLOG_DB_ERR_RECORD_NOT_FOUND"},
{0 , "Event tag not found"}
};
// Below is built from \\index1\sdnt\ds\dns\server\server\dnsmsg.mc
FRS_EL_ENTRY DNSSvcEvents[] = { {1 ,"DNS_EVENT_STARTING"}, {2 ,"DNS_EVENT_STARTUP_OK"}, {3 ,"DNS_EVENT_SHUTDOWN"}, {111 ,"DNS_EVENT_CANNOT_CREATE_THREAD"}, {112 ,"DNS_EVENT_RECURSION_INIT_FAILED"}, {113 ,"DNS_EVENT_SERVICE_NOTIFY"}, {130 ,"DNS_EVENT_WINS_INIT_FAILED"}, {131 ,"DNS_EVENT_NBSTAT_INIT_FAILED"}, {132 ,"DNS_EVENT_NBSTAT_ADAPTER_FAILED"}, {140 ,"DNS_EVENT_RPC_SERVER_INIT_FAILED"}, {403 ,"DNS_EVENT_CANNOT_CREATE_TCP_SOCKET"}, {404 ,"DNS_EVENT_CANNOT_BIND_TCP_SOCKET"}, {405 ,"DNS_EVENT_CANNOT_LISTEN_TCP_SOCKET"}, {406 ,"DNS_EVENT_CANNOT_CREATE_UDP_SOCKET"}, {407 ,"DNS_EVENT_CANNOT_BIND_UDP_SOCKET"}, {408 ,"DNS_EVENT_OPEN_SOCKET_FOR_ADDRESS"}, {409 ,"DNS_EVENT_UPDATE_LISTEN_ADDRESSES"}, {410 ,"DNS_EVENT_INVALID_LISTEN_ADDRESSES"}, {411 ,"DNS_EVENT_HOSTENT_MAX_IPS"}, {412 ,"DNS_EVENT_MANY_IP_INTERFACES"}, {413 ,"DNS_EVENT_NON_DNS_PORT"}, {414 ,"DNS_EVENT_SINGLE_LABEL_HOSTNAME"}, {500 ,"DNS_EVENT_INVALID_REGISTRY_ZONE"}, {501 ,"DNS_EVENT_INVALID_ZONE_TYPE"}, {502 ,"DNS_EVENT_NO_ZONE_FILE"}, {503 ,"DNS_EVENT_SECONDARY_REQUIRES_MASTERS"}, {504 ,"DNS_EVENT_REG_ZONE_CREATION_FAILED"}, {505 ,"DNS_EVENT_INVALID_REGISTRY_ZONE_DATA"}, {506 ,"DNS_EVENT_INVALID_REGISTRY_PARAM"}, {507 ,"DNS_EVENT_INVALID_REGISTRY_FORWARDERS"}, {706 ,"DNS_EVENT_NO_ROOT_NAME_SERVER"}, {707 ,"DNS_EVENT_NO_CACHE_FILE_SPECIFIED"}, {708 ,"DNS_EVENT_CACHING_SERVER_ONLY"}, {800 ,"DNS_EVENT_ZONE_BAD_PRIMARY_SERVER"}, {1000 ,"DNS_EVENT_FILE_OPEN_ERROR"}, {1001 ,"DNS_EVENT_FILE_NOT_MAPPED"}, {1003 ,"DNS_EVENT_CACHE_FILE_NOT_FOUND"}, {1004 ,"DNS_EVENT_COULD_NOT_OPEN_DATABASE"}, {1008 ,"DNS_EVENT_FILE_PATH_TOO_LONG"}, {1200 ,"DNS_EVENT_BOOT_FILE_NOT_FOUND"}, {1201 ,"DNS_EVENT_ZONE_CREATION_FAILED"}, {1202 ,"DNS_EVENT_DIRECTORY_DIRECTIVE"}, {1203 ,"DNS_EVENT_NO_FORWARDING_ADDRESSES"}, {1204 ,"DNS_EVENT_SLAVE_REQUIRES_FORWARDERS"}, {1205 ,"DNS_EVENT_UNKNOWN_BOOTFILE_OPTION"}, {1206 ,"DNS_EVENT_MISSING_DIRECTORY_NAME"}, {1501 ,"DNS_EVENT_COULD_NOT_PARSE_DATABASE"}, {1502 ,"DNS_EVENT_DATABASE_PARSING_ERROR"}, {1503 ,"DNS_EVENT_PARSING_ERROR_LINE"}, {1504 ,"DNS_EVENT_UNEXPECTED_TOKEN"}, {1505 ,"DNS_EVENT_UNEXPECTED_END_OF_TOKENS"}, {1506 ,"DNS_EVENT_INVALID_TOKEN"}, {1507 ,"DNS_EVENT_INVALID_CLASS_TOKEN"}, {1508 ,"DNS_EVENT_IGNORING_FILE_RECORD"}, {1520 ,"DNS_EVENT_UNKNOWN_DIRECTIVE"}, {1521 ,"DNS_EVENT_UNSUPPORTED_DIRECTIVE"}, {1522 ,"DNS_EVENT_OBSOLETE_DIRECTIVE"}, {1523 ,"DNS_EVENT_DIRECTIVE_NOT_YET_IMPLEMENTED"}, {1540 ,"DNS_EVENT_DOMAIN_NODE_CREATION_ERROR"}, {1541 ,"DNS_EVENT_PARSED_INVALID_DOMAIN_NAME"}, {1542 ,"DNS_EVENT_INVALID_DOTTED_DOMAIN_NAME"}, {1543 ,"DNS_EVENT_DOMAIN_NAME_TOO_LONG"}, {1544 ,"DNS_EVENT_INVALID_ORIGIN_TOKEN"}, {1545 ,"DNS_EVENT_FILE_NODE_OUTSIDE_ZONE"}, {1546 ,"DNS_EVENT_FILE_INVALID_NS_NODE"}, {1547 ,"DNS_EVENT_FILE_INVALID_A_NODE"}, {1600 ,"DNS_EVENT_UNKNOWN_RESOURCE_RECORD_TYPE"}, {1601 ,"DNS_EVENT_OBSOLETE_RECORD_SKIPPED"}, {1602 ,"DNS_EVENT_INVALID_SOA_RECORD"}, {1610 ,"DNS_EVENT_PARSED_ADD_RR_AT_CNAME"}, {1611 ,"DNS_EVENT_PARSED_CNAME_NOT_ALONE"}, {1612 ,"DNS_EVENT_PARSED_CNAME_LOOP"}, {1613 ,"DNS_EVENT_INVALID_PREFERENCE"}, {1614 ,"DNS_EVENT_INVALID_DWORD_TOKEN"}, {1616 ,"DNS_EVENT_TEXT_STRING_TOO_LONG"}, {1617 ,"DNS_EVENT_INVALID_IP_ADDRESS_STRING"}, {1618 ,"DNS_EVENT_INVALID_IPV6_ADDRESS"}, {1619 ,"DNS_EVENT_UNKNOWN_PROTOCOL"}, {1620 ,"DNS_EVENT_UNKNOWN_SERVICE"}, {1621 ,"DNS_EVENT_WKS_PORT_UNSUPPORTED"}, {1650 ,"DNS_EVENT_INVALID_WINS_RECORD"}, {1651 ,"DNS_EVENT_INVALID_NBSTAT_RECORD"}, {1654 ,"DNS_EVENT_UNKNOWN_WINS_FLAG"}, {1656 ,"DNS_EVENT_NO_NBSTAT_DOMAIN"}, {2000 ,"DNS_BOOTFILE_BACKUP_MESSAGE"}, {2001 ,"DNS_BOOTFILE_BACKUP_MESSAGE"}, {2002 ,"DNS_EVENT_BOOTFILE_REWRITE"}, {2003 ,"DNS_EVENT_BOOTFILE_WRITE_ERROR"}, {2004 ,"DNS_EVENT_SWITCH_TO_BOOTFILE"}, {2005 ,"DNS_EVENT_SWITCH_TO_BOOTFILE"}, {2200 ,"DNS_EVENT_REGISTRY_OPEN_FAILED"}, {2202 ,"DNS_EVENT_REGISTRY_WRITE_FAILED"}, {2203 ,"DNS_EVENT_REGISTRY_DELETE_FAILED"}, {2501 ,"DNS_EVENT_AGING_SCAVENGING_END"}, {2502 ,"DNS_EVENT_AGING_SCAVENGING_END_NO_WORK"}, {2600 ,"DNS_EVENT_SERVER_SUPPRESSION"}, {2601 ,"DNS_EVENT_ZONE_SUPPRESSION"}, {3000 ,"DNS_EVENT_START_LOG_SUPPRESS"}, {3150 ,"DNS_EVENT_ZONE_WRITE_COMPLETED"}, {3151 ,"DNS_EVENT_ZONE_WRITE_FAILED"}, {3152 ,"DNS_EVENT_FILE_NOT_OPENED_FOR_WRITE"}, {3153 ,"DNS_EVENT_WRITE_FILE_FAILURE"}, {3160 ,"DNS_EVENT_UNWRITABLE_RECORD_TYPE"}, {3162 ,"DNS_EVENT_UNKNOWN_PROTOCOL_NUMBER"}, {3163 ,"DNS_EVENT_UNKNOWN_SERVICE_PORT"}, {4000 ,"DNS_EVENT_DS_OPEN_FAILED"}, {4001 ,"DNS_EVENT_DS_ZONE_OPEN_FAILED"}, {4002 ,"DNS_EVENT_DS_ZONE_ADD_FAILED"}, {4003 ,"DNS_EVENT_DS_ZONE_DELETE_FAILED"}, {4004 ,"DNS_EVENT_DS_ZONE_ENUM_FAILED"}, {4005 ,"DNS_EVENT_DS_ZONE_DELETE_DETECTED"}, {4006 ,"DNS_EVENT_DS_NODE_LOAD_FAILED"}, {4007 ,"DNS_EVENT_DS_REGISTRY_DP_INVALID"}, {4010 ,"DNS_EVENT_DS_RECORD_LOAD_FAILED"}, {4011 ,"DNS_EVENT_DS_WRITE_FAILED"}, {4012 ,"DNS_EVENT_DS_WRITE_TIMEOUT"}, {4013 ,"DNS_EVENT_DS_OPEN_WAIT"}, {4014 ,"DNS_EVENT_DS_SECURITY_INIT_FAILURE"}, {4015 ,"DNS_EVENT_DS_INTERFACE_ERROR"}, {4016 ,"DNS_EVENT_DS_LDAP_TIMEOUT"}, {4017 ,"DNS_EVENT_DS_DNSADMINS_ERROR"}, {4500 ,"DNS_EVENT_DP_CREATED"}, {4501 ,"DNS_EVENT_DP_DELETED"}, {4502 ,"DNS_EVENT_DP_ENLISTED"}, {4503 ,"DNS_EVENT_DP_UNENLISTED"}, {4510 ,"DNS_EVENT_DP_FSMO_UNAVAILABLE"}, {4511 ,"DNS_EVENT_DP_DEL_DURING_CHANGE_ERR"}, {4512 ,"DNS_EVENT_DP_CANT_CREATE_BUILTIN"}, {4513 ,"DNS_EVENT_DP_CANT_JOIN_FOREST_BUILTIN"}, {4514 ,"DNS_EVENT_DP_CANT_JOIN_DOMAIN_BUILTIN"}, {4515 ,"DNS_EVENT_DP_ZONE_CONFLICT"}, {5050 ,"DNS_EVENT_ASSERT"}, {5051 ,"DNS_EVENT_EXCESSIVE_MEMORY_USE"}, {5105 ,"DNS_EVENT_ADDING_RR_AT_CNAME"}, {5106 ,"DNS_EVENT_CNAME_NOT_ALONE"}, {5107 ,"DNS_EVENT_CNAME_LOOP"}, {5108 ,"DNS_EVENT_CNAME_LOOP_LINK"}, {5500 ,"DNS_EVENT_BAD_QUERY"}, {5501 ,"DNS_EVENT_BAD_PACKET_LENGTH"}, {5502 ,"DNS_EVENT_BAD_TCP_MESSAGE"}, {5504 ,"DNS_EVENT_INVALID_PACKET_DOMAIN_NAME"}, {5505 ,"DNS_EVENT_PACKET_NAME_TOO_LONG"}, {5506 ,"DNS_EVENT_PACKET_NAME_BAD_OFFSET"}, {5507 ,"DNS_EVENT_PACKET_NAME_OFFSET_TOO_LONG"}, {5508 ,"DNS_EVENT_PACKET_NAME_TOO_MANY_LABELS"}, {5509 ,"DNS_EVENT_BAD_UPDATE_PACKET"}, {5510 ,"DNS_EVENT_BAD_RESPONSE_PACKET"}, {6000 ,"DNS_EVENT_ZONEXFR_START"}, {6001 ,"DNS_EVENT_ZONEXFR_SUCCESSFUL"}, {6002 ,"DNS_EVENT_ZONEXFR_ABORTED"}, {6003 ,"DNS_EVENT_UDP_ZONE_TRANSFER"}, {6004 ,"DNS_EVENT_BAD_ZONE_TRANSFER_REQUEST"}, {6520 ,"DNS_EVENT_ZONE_UPDATE"}, {6521 ,"DNS_EVENT_ZONE_IN_SYNC"}, {6522 ,"DNS_EVENT_ZONE_TRANSFER_IN_PROGRESS"}, {6523 ,"DNS_EVENT_XFR_MASTER_UNAVAILABLE"}, {6524 ,"DNS_EVENT_AXFR_BAD_RESPONSE"}, {6525 ,"DNS_EVENT_AXFR_REFUSED"}, {6526 ,"DNS_EVENT_ZONE_NEWER_THAN_SERVER_VERSION"}, {6527 ,"DNS_EVENT_ZONE_EXPIRATION"}, {6530 ,"DNS_EVENT_XFR_ADD_RR_AT_CNAME"}, {6531 ,"DNS_EVENT_XFR_CNAME_NOT_ALONE"}, {6532 ,"DNS_EVENT_XFR_CNAME_LOOP"}, {6533 ,"DNS_EVENT_AXFR_INIT_FAILED"}, {6534 ,"DNS_EVENT_XFR_ABORTED_BY_MASTER"}, {6535 ,"DNS_EVENT_IXFR_UNSUPPORTED"}, {6536 ,"DNS_EVENT_IXFR_BAD_RESPONSE"}, {6701 ,"DNS_EVENT_UPDATE_DS_PEERS_SUCCESS"}, {6702 ,"DNS_EVENT_UPDATE_DS_PEERS_FAILURE"}, {7050 ,"DNS_EVENT_RECV_CALL_FAILED"}, {7051 ,"DNS_EVENT_RECVFROM_CALL_FAILED"}, {7052 ,"DNS_EVENT_SEND_CALL_FAILED"}, {7053 ,"DNS_EVENT_SENDTO_CALL_FAILED"}, {7054 ,"DNS_EVENT_SELECT_CALL_FAILED"}, {7055 ,"DNS_EVENT_ACCEPT_CALL_FAILED"}, {7056 ,"DNS_EVENT_GQCS_CALL_FAILED"}, {7060 ,"DNS_EVENT_CANNOT_CONNECT_TO_SERVER"}, {7061 ,"DNS_EVENT_CANNOT_SET_WINS_BROADCAST"}, {7062 ,"DNS_EVENT_SELF_SEND"}, {7063 ,"DNS_EVENT_NON_RECURSIVE_FORWARDER"}, {7500 ,"DNS_EVENT_SERVER_FAILURE_PROCESSING_PACKET"}, {7502 ,"DNS_EVENT_OUT_OF_MEMORY"}, {7503 ,"DNS_EVENT_CANNOT_ALLOCATE_RECORD"}, {7504 ,"DNS_EVENT_CANNOT_ALLOCATE_NODE"}, {9999 ,"DNS_EVENT_CONTINUE_LOG_SUPPRESS"}, {10101 ,"DNSMSG_FILE_HEADER"}, {10102 ,"DNSMSG_FILE_VERSION"}, {10103 ,"DNSMSG_FILE_DELEGATION"}, {10104 ,"DNSMSG_FILE_DELEGATION_END"}, {10105 ,"DNSMSG_FILE_NAME_SERVERS"}, {10106 ,"DNSMSG_FILE_WINS"}, {10107 ,"DNSMSG_FILE_WINSR"}, {10108 ,"DNSMSG_FILE_ZONE_RECORDS"},
{0 , "Event tag not found"}
};
/*
// The following came from \\index1\sdnt\ds\security\base\lsa\idl\lsapmsgs.mc
// Not sure of the facility names. Presumably these go into the security event log.
MessageIdTypedef=DWORD MessageId=0x1FFF SymbolicName=LSAP_UNUSED_MESSAGE MessageId=0x2000 SymbolicName=LSAP_SID_NAME_NULL MessageId=0x2001 SymbolicName=LSAP_SID_NAME_WORLD MessageId=0x2002 SymbolicName=LSAP_SID_NAME_LOCAL MessageId=0x2003 SymbolicName=LSAP_SID_NAME_CREATOR_OWNER MessageId=0x2004 SymbolicName=LSAP_SID_NAME_CREATOR_GROUP MessageId=0x2005 SymbolicName=LSAP_SID_NAME_NT_DOMAIN MessageId=0x2006 SymbolicName=LSAP_SID_NAME_NT_AUTHORITY MessageId=0x2007 SymbolicName=LSAP_SID_NAME_DIALUP MessageId=0x2008 SymbolicName=LSAP_SID_NAME_NETWORK MessageId=0x2009 SymbolicName=LSAP_SID_NAME_BATCH MessageId=0x200A SymbolicName=LSAP_SID_NAME_INTERACTIVE MessageId=0x200B SymbolicName=LSAP_SID_NAME_SERVICE MessageId=0x200C SymbolicName=LSAP_SID_NAME_BUILTIN MessageId=0x200D SymbolicName=LSAP_SID_NAME_SYSTEM MessageId=0x200E SymbolicName=LSAP_SID_NAME_ANONYMOUS MessageId=0x200f SymbolicName=LSAP_SID_NAME_CREATOR_OWNER_SERVER MessageId=0x2010 SymbolicName=LSAP_SID_NAME_CREATOR_GROUP_SERVER MessageId=0x2011 SymbolicName=LSAP_SID_NAME_SERVER MessageId=0x2012 SymbolicName=LSAP_SID_NAME_SELF MessageId=0x2013 SymbolicName=LSAP_SID_NAME_AUTHENTICATED_USER MessageId=0x2014 SymbolicName=LSAP_SID_NAME_RESTRICTED MessageId=0x2015 SymbolicName=LSAP_SID_NAME_INTERNET MessageId=0x2016 SymbolicName=LSAP_SID_NAME_TERMINAL_SERVER MessageId=0x2017 SymbolicName=LSAP_SID_NAME_PROXY MessageId=0x2018 SymbolicName=LSAP_SID_NAME_LOCALSERVICE MessageId=0x2019 SymbolicName=LSAP_SID_NAME_NETWORKSERVICE MessageId=0x201A SymbolicName=LSAP_SID_NAME_REMOTE_INTERACTIVE MessageId=0x201B SymbolicName=LSAP_SID_NAME_USERS MessageId=0x4000 SymbolicName=LSAP_DEFAULT_DOMAIN_NAME MessageId=1 Severity=Success SymbolicName=CATEGORY_SPM MessageId= Severity=Success SymbolicName=CATEGORY_LOCATOR MessageId= Severity=Success SymbolicName=CATEGORY_NEGOTIATE MessageId= Severity=Success SymbolicName=CATEGORY_MAX_CATEGORY MessageId=4000 Severity=Warning SymbolicName=SPMEVENT_SUPPCRED_FAILED MessageId=5000 Severity=Error SymbolicName=SPMEVENT_PACKAGE_FAULT MessageId=6000 Severity=Informational Facility=EFSServer SymbolicName=EFS_RECOVERY_STARTED MessageId=6001 Severity=Error Facility=EFSServer SymbolicName=EFS_PNP_NOT_READY MessageId=6002 Severity=Error Facility=EFSServer SymbolicName=EFS_GET_VOLUMES_ERROR MessageId=6003 Severity=Informational Facility=EFSServer SymbolicName=EFS_FT_STARTED MessageId=6004 Severity=Error Facility=EFSServer SymbolicName=EFS_OPEN_LOGFILE_ERROR MessageId=6005 Severity=Error Facility=Io SymbolicName=EFS_READ_LOGFILE_ERROR MessageId=6006 Severity=Informational Facility=EFSServer SymbolicName=EFS_LOGFILE_FORMAT_ERROR MessageId=6007 Severity=Error Facility=EFSServer SymbolicName=EFS_OPEN_LOGFILE_NC_ERROR MessageId=6008 Severity=Warning Facility=EFSServer SymbolicName=EFS_TMP_FILENAME_ERROR MessageId=6009 Severity=Error Facility=EFSServer SymbolicName=EFS_TMP_FILEID_ERROR MessageId=6010 Severity=Warning Facility=EFSServer SymbolicName=EFS_TMP_OPEN_NAME_ERROR MessageId=6011 Severity=Error Facility=EFSServer SymbolicName=EFS_TARGET_OPEN_ERROR MessageId=6012 Severity=Informational Facility=EFSServer SymbolicName=EFS_TARGET_RECOVERED MessageId=6013 Severity=Error Facility=EFSServer SymbolicName=EFS_DRIVER_MISSING MessageId=6014 Severity=Error Facility=EFSServer SymbolicName=EFS_TMPFILE_MISSING MessageId=6015 Severity=Error Facility=EFSServer SymbolicName=EFS_TMP_STREAM_INFO_ERROR MessageId=6016 Severity=Error Facility=EFSServer SymbolicName=EFS_TMP_STREAM_OPEN_ERROR MessageId=6017 Severity=Error Facility=EFSServer SymbolicName=EFS_TARGET_STREAM_OPEN_ERROR MessageId=6018 Severity=Error Facility=EFSServer SymbolicName=EFS_STREAM_COPY_ERROR MessageId=6019 Severity=Error Facility=EFSServer SymbolicName=EFS_REPARSE_FILE_ERROR MessageId=6020 Severity=Error Facility=EFSServer SymbolicName=EFS_TMP_FILE_ERROR MessageId=6021 Severity=Error Facility=EFSServer SymbolicName=EFS_DIR_MULTISTR_ERROR MessageId=6022 Severity=Error Facility=EFSServer SymbolicName=EFS_OPEN_CACHE_ERROR MessageId=6023 Severity=Warning Facility=EFSServer SymbolicName=EFS_DEL_LOGFILE_ERROR MessageId=6024 Severity=Error Facility=EFSServer SymbolicName=EFS_BAD_RECOVERY_POLICY_ERROR MessageId=6025 Severity=Error Facility=System SymbolicName=LSA_TRUST_UPGRADE_ERROR MessageId=6026 Severity=Error Facility=System SymbolicName=LSA_ITA_UPGRADE_ERROR MessageId=6027 Severity=Error Facility=System SymbolicName=LSA_SECRET_UPGRADE_ERROR MessageId=6028 Severity=Error Facility=EFSServer SymbolicName=EFS_INVALID_RECOVERY_POLICY_ERROR MessageId=6029 Severity=Error Facility=System SymbolicName=LSA_DOMAIN_RENAME_ERROR1 ;//MessageId=6030 Severity=Error Facility=System SymbolicName=LSA_DOMAIN_RENAME_ERROR2
MessageId=6031 Severity=Error Facility=System SymbolicName=LSA_TRUST_INSERT_ERROR MessageId=6032 Severity=Error Facility=EFSServer SymbolicName=EFS_NTLM_ERROR MessageId=0x7000 Severity=Success SymbolicName=DSROLEEVT_SEARCH_DC MessageId=0x7001 Severity=Success SymbolicName=DSROLEEVT_FOUND_DC MessageId=0x7002 Severity=Success SymbolicName=DSROLEEVT_FOUND_SITE MessageId=0x7003 Severity=Success SymbolicName=DSROLEEVT_STOP_SERVICE MessageId=0x7004 Severity=Success SymbolicName=DSROLEEVT_CONFIGURE_SERVICE MessageId=0x7005 Severity=Success SymbolicName=DSROLEEVT_START_SERVICE MessageId=0x7006 Severity=Success SymbolicName=DSROLEEVT_INSTALL_DS MessageId=0x7007 Severity=Success SymbolicName=DSROLEEVT_REPLICATE_SCHEMA MessageId=0x7008 Severity=Success SymbolicName=DSROLEEVT_SET_LSA MessageId=0x7009 Severity=Success SymbolicName=DSROLEEVT_SET_LSA_FROM MessageId=0x7010 Severity=Success SymbolicName=DSROLEEVT_CREATE_TRUST MessageId=0x7011 Severity=Success SymbolicName=DSROLEEVT_PRODUCT_TYPE MessageId=0x7012 Severity=Success SymbolicName=DSROLEEVT_LSA_UPGRADE MessageId=0x7013 Severity=Success SymbolicName=DSROLEEVT_CREATE_SYSVOL MessageId=0x7014 Severity=Success SymbolicName=DSROLEEVT_CREATE_SYSVOL_DIR MessageId=0x7015 Severity=Success SymbolicName=DSROLEEVT_DELETE_TRUST MessageId=0x7016 Severity=Success SymbolicName=DSROLEEVT_RESTORE_LSA MessageId=0x7017 Severity=Success SymbolicName=DSROLEEVT_MACHINE_ACCT MessageId=0x7018 Severity=Success SymbolicName=DSROLEEVT_PROMOTION_COMPLETE MessageId=0x7019 Severity=Success SymbolicName=DSROLEEVT_CREATE_PARENT_TRUST MessageId=0x7020 Severity=Success SymbolicName=DSROLEEVT_SEARCH_REPLICA MessageId=0x7021 Severity=Success SymbolicName=DSROLEEVT_FOUND_REPLICA MessageId=0x7022 Severity=Success SymbolicName=DSROLEEVT_MACHINE_POLICY MessageId=0x7023 Severity=Success SymbolicName=DSROLEEVT_IMPERSONATE MessageId=0x7024 Severity=Success SymbolicName=DSROLEEVT_REVERT MessageId=0x7025 Severity=Success SymbolicName=DSROLEEVT_LOCAL_POLICY MessageId=0x7026 Severity=Success SymbolicName=DSROLEEVT_PREPARE_DEMOTION MessageId=0x7027 Severity=Success SymbolicName=DSROLEEVT_UNINSTALL_DS MessageId=0x7028 Severity=Success SymbolicName=DSROLEEVT_SVSETUP MessageId=0x7029 Severity=Success SymbolicName=DSROLEEVT_COPY_DIT MessageId=0x7030 Severity=Success SymbolicName=DSROLEEVT_FIND_DC_FOR_ACCOUNT MessageId=0x7031 Severity=Success SymbolicName=DSROLEEVT_SETTING_SECURITY MessageId=0x7032 Severity=Success SymbolicName=DSROLEEVT_UNJOIN_DOMAIN MessageId=0x7033 Severity=Success SymbolicName=DSROLEEVT_TIMESYNC MessageId=0x7034 Severity=Success SymbolicName=DSROLEEVT_UPGRADE_SAM MessageId=0x7035 Severity=Success SymbolicName=DSROLEEVT_MOVE_SCRIPTS MessageId=0x7036 Severity=Success SymbolicName=DSROLEEVT_SET_COMPUTER_DNS MessageId=0x7037 Severity=Success SymbolicName=DSROLEEVT_SCRIPTS_MOVED MessageId=0x7038 Severity=Success SymbolicName=DSROLEEVT_COPY_RESTORED_FILES MessageId=0x7100 Severity=Success SymbolicName=DSROLESTATUS_MACH_CONFIG MessageId=0x7101 Severity=Success SymbolicName=DSROLESTATUS_INSTALL_DS MessageId=0x7102 Severity=Success SymbolicName=DSROLESTATUS_INSTALL_SYSVOL MessageId=0x7103 Severity=Success SymbolicName=DSROLESTATUS_TREE MessageId=0x7104 Severity=Success SymbolicName=DSROLESTATUS_SERVICES MessageId=0x7105 Severity=Success SymbolicName=DSROLESTATUS_SECURITY MessageId=0x7106 Severity=Success SymbolicName=DSROLESTATUS_MEMBERSHIP MessageId=0x7108 Severity=Success SymbolicName=DSROLESTATUS_DEMOTABLE MessageId=0x7109 Severity=Success SymbolicName=DSROLESTATUS_UNINSTALL_DS MessageId=0x710a Severity=Success SymbolicName=DSROLESTATUS_UNINSTALL_SYSVOL MessageId=0x7200 Severity=Success SymbolicName=DSROLERES_PROMO_SUCCEEDED MessageId=0x7201 Severity=Error SymbolicName=DSROLERES_PROMO_FAILED MessageId=0x7202 Severity=Error SymbolicName=DSROLERES_FAIL_SCRIPT_COPY MessageId=0x7203 Severity=Error SymbolicName=DSROLERES_FAIL_SET_SECURITY MessageId=0x7204 Severity=Error SymbolicName=DSROLERES_INCOMPATIBLE_TRUST MessageId=0x7205 Severity=Error SymbolicName=DSROLERES_FIND_DC MessageId=0x7206 Severity=Error SymbolicName=DSROLERES_IMPERSONATION MessageId=0x7207 Severity=Error SymbolicName=DSROLERES_NET_USE MessageId=0x7208 Severity=Error SymbolicName=DSROLERES_TIME_SYNC MessageId=0x7209 Severity=Error SymbolicName=DSROLERES_POLICY_READ_REMOTE MessageId=0x7210 Severity=Error SymbolicName=DSROLERES_POLICY_READ_LOCAL MessageId=0x7211 Severity=Error SymbolicName=DSROLERES_POLICY_WRITE_LOCAL MessageId=0x7212 Severity=Error SymbolicName=DSROLERES_LSA_UPGRADE MessageId=0x7213 Severity=Error SymbolicName=DSROLERES_LOGON_DOMAIN MessageId=0x7214 Severity=Error SymbolicName=DSROLERES_SET_COMPUTER_DNS MessageId=0x7215 Severity=Error SymbolicName=DSROLERES_MODIFY_MACHINE_ACCOUNT MessageId=0x7216 Severity=Error SymbolicName=DSROLERES_LEAF_DOMAIN MessageId=0x7217 Severity=Error SymbolicName=DSROLERES_SYSVOL_DEMOTION MessageId=0x7218 Severity=Error SymbolicName=DSROLERES_DEMOTE_DS MessageId=0x7219 Severity=Error SymbolicName=DSROLERES_SERVICE_CONFIGURE MessageId=0x721A Severity=Error SymbolicName=DSROLERES_PRODUCT_TYPE MessageId=0x721B Severity=Error SymbolicName=DSROLERES_PARENT_TRUST_EXISTS MessageId=0x721C Severity=Error SymbolicName=DSROLERES_PARENT_TRUST_FAIL MessageId=0x721D Severity=Error SymbolicName=DSROLERES_NO_PARENT_TRUST MessageId=0x721E Severity=Error SymbolicName=DSROLERES_TRUST_FAILURE MessageId=0x721F Severity=Error SymbolicName=DSROLERES_TRUST_CONFIGURE_FAILURE MessageId=0x7220 Severity=Error SymbolicName=DSROLERES_FAIL_DISABLE_AUTO_LOGON MessageId=0x7221 Severity=Error SymbolicName=DSROLERES_FAIL_LOGON_DOMAIN MessageId=0x7222 Severity=Error SymbolicName=DSROLERES_FAIL_UNJOIN MessageId=0x7223 Severity=Error SymbolicName=DSROLERES_NOT_FOREST_ROOT MessageId=0x7224 Severity=Error SymbolicName=DSROLERES_GPO_CREATION MessageId=0x7225 Severity=Error SymbolicName=DSROLERES_FAILED_TO_DELETE_TRUST MessageId=0x7226 Severity=Error SymbolicName=DSROLERES_FAILED_TO_DEMOTE_FRS MessageId=0x7227 Severity=Informational SymbolicName=DSROLERES_PROMOTE_SUCCESS MessageId=0x7228 Severity=Informational SymbolicName=DSROLERES_DEMOTE_SUCCESS MessageId=0x7229 Severity=Informational SymbolicName=DSROLERES_STARTING MessageId=0x7230 Severity=Informational SymbolicName=DSROLERES_SYSVOL_DIR_ERROR MessageId=0x7231 Severity=Informational SymbolicName=DSROLERES_OP_CANCELLED MessageId=0x7232 Severity=Error SymbolicName=DSROLERES_UPDATE_PRENT4_ACCOUNT MessageId=0x7233 Severity=Error SymbolicName=DSROLERES_WRONG_DOMAIN MessageId=0x7234 Severity=Error SymbolicName=DSROLERES_FAILED_SYSVOL_CANNOT_BE_ROOT_DIRECTORY MessageId=0x7235 Severity=Error SymbolicName=DSROLERES_FAILED_FIND_REQUESTED_DC MessageId=0x7236 Severity=Error SymbolicName=DSROLERES_FAILED_FIND_SITE MessageId=0x8000 Severity=Warning SymbolicName=LSAEVENT_ITA_NOT_DELETED MessageId=0x8001 Severity=Warning SymbolicName=LSAEVENT_TRUST_FOR_ITA_NOT_CREATED MessageId=0x8002 Severity=Warning SymbolicName=LSAEVENT_TRUST_FOR_ITA_NOT_DELETED MessageId=0x8003 Severity=Warning SymbolicName=LSAEVENT_DUP_TRUST_REMOVED MessageId=0x8004 Severity=Warning SymbolicName=LSAEVENT_ITA_FOR_TRUST_NOT_CREATED MessageId=0x8005 Severity=Warning SymbolicName=LSAEVENT_LOOKUP_SC_FAILED MessageId=0x8006 Severity=Warning SymbolicName=LSAEVENT_LOOKUP_SC_HANDLE_FAILED MessageId=0x8007 Severity=Warning SymbolicName=LSAEVENT_LOOKUP_SC_LOOKUP_FAILED MessageId=0x8008 Severity=Warning SymbolicName=LSAEVENT_LOOKUP_GC_FAILED MessageId=0x8009 Severity=Warning SymbolicName=LSAEVENT_LOOKUP_TCPIP_NOT_INSTALLED MessageId=0x800A Severity=Warning SymbolicName=LSAEVENT_LOOKUP_SID_FILTERED MessageId=0x9000 Severity=Informational SymbolicName=SSLEVENT_SCHANNEL_STARTED MessageId=0x9001 Severity=Error SymbolicName=SSLEVENT_GLOBAL_ACQUIRE_CONTEXT_FAILED MessageId=0x9002 Severity=Error SymbolicName=SSLEVENT_SCHANNEL_INIT_FAILURE MessageId=0x9003 Severity=Informational SymbolicName=SSLEVENT_CREATE_CRED MessageId=0x9004 Severity=Informational SymbolicName=SSLEVENT_CRED_PROPERTIES MessageId=0x9005 Severity=Error SymbolicName=SSLEVENT_NO_PRIVATE_KEY MessageId=0x9006 Severity=Error SymbolicName=SSLEVENT_CRED_ACQUIRE_CONTEXT_FAILED MessageId=0x9007 Severity=Error SymbolicName=SSLEVENT_CREATE_CRED_FAILED MessageId=0x9008 Severity=Warning SymbolicName=SSLEVENT_NO_DEFAULT_SERVER_CRED MessageId=0x9009 Severity=Error SymbolicName=SSLEVENT_NO_CIPHERS_SUPPORTED MessageId=0x900a Severity=Error SymbolicName=SSLEVENT_CIPHER_MISMATCH MessageId=0x900b Severity=Warning SymbolicName=SSLEVENT_NO_CLIENT_CERT_FOUND MessageId=0x900c Severity=Error SymbolicName=SSLEVENT_BOGUS_SERVER_CERT MessageId=0x900d Severity=Warning SymbolicName=SSLEVENT_BOGUS_CLIENT_CERT MessageId=0x900e Severity=Warning SymbolicName=SSLEVENT_FAST_MAPPING_FAILURE MessageId=0x900f Severity=Warning SymbolicName=SSLEVENT_CERT_MAPPING_FAILURE MessageId=0x9010 Severity=Informational SymbolicName=SSLEVENT_HANDSHAKE_INFO MessageId=0x9011 Severity=Error SymbolicName=SSLEVENT_EXPIRED_SERVER_CERT MessageId=0x9012 Severity=Error SymbolicName=SSLEVENT_UNTRUSTED_SERVER_CERT MessageId=0x9013 Severity=Error SymbolicName=SSLEVENT_REVOKED_SERVER_CERT MessageId=0x9014 Severity=Error SymbolicName=SSLEVENT_NAME_MISMATCHED_SERVER_CERT MessageId=0x9015 Severity=Warning SymbolicName=SSLEVENT_ISSUER_LIST_OVERFLOW_FAILURE MessageId=0x9080 SymbolicName=SSLEVENTTEXT_CLIENT MessageId=0x9081 SymbolicName=SSLEVENTTEXT_SERVER MessageId=0xa000 Severity=Warning SymbolicName=NEGOTIATE_DOWNGRADE_DETECTED MessageId=0xa001 Severity=Warning SymbolicName=NEGOTIATE_INVALID_SERVER MessageId=0xa002 Severity=Warning SymbolicName=NEGOTIATE_UNBALANCED_EXCHANGE MessageId=0xa003 Severity=Warning SymbolicName=NEGOTIATE_PACKAGE_FAILED MessageId=0xa004 Severity=Warning SymbolicName=NEGOTIATE_UNKNOWN_PACKAGE MessageId=0xa005 Severity=Informational SymbolicName=NEGOTIATE_PACKAGE_SELECTED MessageId=0xa006 Severity=Informational SymbolicName=NEGOTIATE_MESSAGE_DECODED MessageId=0xa007 Severity=Informational SymbolicName=NEGOTIATE_RAW_PACKET MessageId=0xa008 Severity=Warning SymbolicName=NEGOTIATE_UNKNOWN_PACKET MessageId=0xa009 Severity=Informational SymbolicName=NEGOTIATE_MESSAGE_DECODED_NO_TOKEN
*/
PCHAR GenIdToTag ( DWORD ID, PFRS_EL_ENTRY Etab ) { DWORD j = 0;
while (((Etab[j].EventId & 0x0FFFFFFF) != ID) && (Etab[j].EventId != 0)) {j++;}
return Etab[j].EventTag; }
PCHAR JetIdToTag ( DWORD ID ) { DWORD j = 0;
while (((JetEvents[j].EventId & 0x0FFFFFFF) != ID) && (JetEvents[j].EventId != 0)) {j++;}
return JetEvents[j].EventTag; }
PCHAR KDCIdToTag ( DWORD ID ) { DWORD j = 0;
while (((KDCEvents[j].EventId & 0x0FFFFFFF) != ID) && (KDCEvents[j].EventId != 0)) {j++;}
return KDCEvents[j].EventTag; }
PCHAR TimeservIdToTag ( DWORD ID ) { DWORD j = 0;
while (((TimeservEvents[j].EventId & 0x0FFFFFFF) != ID) && (TimeservEvents[j].EventId != 0)) {j++;}
return TimeservEvents[j].EventTag; }
PCHAR NetLogonIdToTag ( DWORD ID ) { DWORD j = 0;
while (((NetlogonEvents[j].EventId & 0x0FFFFFFF) != ID) && (NetlogonEvents[j].EventId != 0)) {j++;}
return NetlogonEvents[j].EventTag; }
PCHAR NetEventIdToTag ( DWORD ID ) { DWORD j = 0;
while (((NetEvents[j].EventId & 0x0FFFFFFF) != ID) && (NetEvents[j].EventId != 0)) {j++;}
return NetEvents[j].EventTag; }
PCHAR DirSvcEventIdToTag ( DWORD ID ) { DWORD j = 0;
while (((DirSvcEvents[j].EventId & 0x0FFFFFFF) != ID) && (DirSvcEvents[j].EventId != 0)) {j++;}
return DirSvcEvents[j].EventTag; }
PCHAR FrsEventIdToTag ( DWORD ID ) { DWORD j = 0;
while ((FrsEvents[j].EventId != ID) && (FrsEvents[j].EventId != 0)) {j++;}
return FrsEvents[j].EventTag; }
PCHAR SystemIoEventIdToTag ( DWORD ID ) { DWORD j = 0;
while ((SystemIoEvents[j].EventId != ID) && (SystemIoEvents[j].EventId != 0)) {j++;}
return SystemIoEvents[j].EventTag; }
VOID EventLogTimeToLocalTime ( DWORD eTime, SYSTEMTIME *plTime ) { LONGLONG time; FILETIME ftime; FILETIME lftime;
// file time @ 1970 + nSec since 1970
time = 0x019DB1DED53E8000 + (LONGLONG)eTime * 10000000;
// convert the LONGLONG time to file time
ftime.dwHighDateTime = (DWORD)(time >> 32); ftime.dwLowDateTime = (DWORD)(time & 0x00000000FFFFFFFF);
// get local file time
FileTimeToLocalFileTime (&ftime, &lftime);
// get local system time
FileTimeToSystemTime (&lftime, plTime);
}
INT FormatTime ( SYSTEMTIME *pLocalTime ) { CHAR szTime[100]; INT iR;
iR = GetTimeFormat (LOCALE_USER_DEFAULT, 0, pLocalTime, NULL, szTime, 100);
if (iR) return printf ("%13s", szTime); else return 0;
}
INT FormatDate ( SYSTEMTIME *pLocalTime ) { CHAR szDate[100]; INT iR;
iR = GetDateFormat (LOCALE_USER_DEFAULT, 0, pLocalTime, "M'/'d'/'yyyy", szDate, 100);
if (iR) return printf ("%11s", szDate); else return 0;
}
int __cdecl main(int argc, char *argv[])
{ HANDLE hEventLog = NULL; DWORD dwNumOfEvents = 0; PVOID pvEventBuffer; PEVENTLOGRECORD pelrCurrEvent = NULL; DWORD dwNumRead = 0, dwNumRequired = 0; PDBENTRY Match=NULL; DWORD dwIteration = 0; BOOL boolBackup=FALSE, boolClear=FALSE, boolRemote=FALSE; char szBackupStub[128], szComputerName[24]; DWORD dwClearInterval = 96, dwBufferSize; DWORD i; DWORD NumRecordsDisplayed = 200; DWORD LoopCount;
szBackupStub[0]='\0'; szComputerName[0]='\0'; szRemoteComputer[0]='\0';
for (i=0;i<(unsigned long) argc;i++) { if (strstr(_strlwr(argv[i]),"/?") || strstr(argv[i],"-?") || strstr(argv[i],"/h") || strstr(argv[i],"-h")) { Usage(); continue; }
if (strstr(argv[i],"/b")) { sscanf(argv[i]," /b:%s",szBackupStub); boolBackup = TRUE; continue; }
if (strstr(argv[i],"/m")) { if (!sscanf(argv[i]," /m:%s",szComputerName)) { Usage(); continue; } continue; }
if (strstr(argv[i],"/r")) { if (!sscanf(argv[i]," /r:%s",szRemoteComputer)) { Usage(); continue; } bRemote = TRUE; continue; }
if (strstr(argv[i],"/l")) { if (!sscanf(argv[i]," /l:%s",szLogType)) { printf("invalid szlogtype: %s\n", argv[i]); Usage(); continue; }
if (_stricmp("DS", szLogType) == 0) { sprintf(szLogType, "Directory Service"); } else if (_stricmp("DNS", szLogType) == 0) { sprintf(szLogType, "DNS Server"); } continue; }
if (strstr(argv[i],"/n")) { if (!sscanf(argv[i]," /n:%d", &NumRecordsDisplayed)) { printf("invalid NumRecordsDisplayed: %s\n", argv[i]); Usage(); continue; } continue; }
if (strstr(argv[i],"/c")) { sscanf(argv[i]," /c:%lu",&dwClearInterval); dwClearInterval *= 4; boolClear=TRUE; continue; }
if (strstr(argv[i],"/o")) { char c;
sscanf(argv[i]," /o:%c",&c); switch (c) { case 'c': enumOutput = eCon; break;
case 'd': enumOutput = eDbg; break;
default: break; } } }
//
// Default to local computer if no name supplied.
//
if (!strlen(szComputerName)) { dwBufferSize = sizeof(szComputerName); GetComputerName(szComputerName,&dwBufferSize); }
if (!strlen(szRemoteComputer)) { dwBufferSize = sizeof(szRemoteComputer); GetComputerName(szRemoteComputer,&dwBufferSize); }
printf("Log Type: %s\n", szLogType); printf("Computer: %s\n", szRemoteComputer); printf("MaxRecordsDisplayed: %d\n", NumRecordsDisplayed);
pvEventBuffer = VirtualAlloc(NULL, SIZE_EVENT_BUFFER, MEM_COMMIT, PAGE_READWRITE);
if (!pvEventBuffer) { sprintf(sp,"EVENTDMP: Unable to allocate sufficient memory -> Error: %lu\n", GetLastError()); SplitPrint(); exit(1); }
i = 0; InitializeDatabase();
if (!(hEventLog = OpenEventLog(szRemoteComputer, szLogType))) { sprintf(sp,"EVENTDMP: Could not open event log -> Error: %lu\n", GetLastError()); SplitPrint(); exit(1); }
if (!GetNumberOfEventLogRecords(hEventLog, &dwNumOfEvents)) { sprintf(sp,"EVENTDMP: Could not get number of records -> Error: %lu\n", GetLastError()); SplitPrint(); }
if (dwNumOfEvents == 0) { sprintf(sp,"EVENTDMP: no event log entries found.\n"); SplitPrint(); return 1; }
sprintf(sp,"EVENTDMP: Attempting to read %d event log entries...\n", dwNumOfEvents); SplitPrint();
LoopCount = 0; while (i < dwNumOfEvents) { if (!ReadEventLog(hEventLog, EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ, 1, pvEventBuffer, SIZE_EVENT_BUFFER, &dwNumRead, &dwNumRequired)) { sprintf(sp, "EVENTDMP: Unable to read event log -> Error: %lu\n", GetLastError()); SplitPrint(); sprintf(sp, "NumRead = %d NumRequired = %d\n", dwNumRead, dwNumRequired); SplitPrint(); if (++LoopCount > 50) goto SCAN_DONE; continue; }
pelrCurrEvent = (PEVENTLOGRECORD) pvEventBuffer;
while ((char *)pelrCurrEvent < (char *)pvEventBuffer+dwNumRead) {
if (i < NumRecordsDisplayed) { PrintEventLogRecord( pelrCurrEvent ); } else { goto SCAN_DONE; }
#if 0
// skip this stuff for now since it doesn't work for remote access anyway.
if ((pelrCurrEvent->EventType & (EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE)) != 0) {
if (!(Match = SearchDatabase(pelrCurrEvent))) { if (!(Match = AddToDatabase(pelrCurrEvent))) { sprintf(sp,"EVENTDMP: Database is full. Unable to add unique Event ID."); SplitPrint(); } } else { if (!(Match = UpdateDatabase(pelrCurrEvent, Match))) { //sprintf(sp,"EVENTDMP: Match error in Database management code");
//SplitPrint();
} } } #endif
pelrCurrEvent = (PEVENTLOGRECORD) ((char*) pelrCurrEvent + pelrCurrEvent->Length); i++; } }
DumpDatabase(); CleanupDatabase();
SCAN_DONE:
if (boolClear && !(dwIteration % dwClearInterval)) { SYSTEMTIME stCurrentTime; char szBackup[128];
sprintf(sp,"EVENTDMP: Attempting to clear event log...\n"); SplitPrint(); GetLocalTime(&stCurrentTime); if (boolBackup) { sprintf(szBackup,"%s%s%c%02d%02d.evt",szBackupStub,strlen(szBackupStub)?"\\":"",szComputerName[0], stCurrentTime.wMonth,stCurrentTime.wDay); } if (!ClearEventLog(hEventLog,szBackup)) { sprintf(sp,"EVENTDMP: Unable to clear event log...ERROR: %d\n", GetLastError()); SplitPrint(); } else { sprintf(sp,"EVENTDMP: Event log cleared...backup file is %s\n", szBackup); SplitPrint(); dwIteration++; } }
CloseEventLog(hEventLog); if (hRegistry != 0) { RegCloseKey(hRegistry); }
free(pvEventBuffer); return(0); }
void InitializeDatabase(void)
{ DWORD i=0;
for (;i<MAX_DB_EINTRIES;i++) { Database[i]=NULL; }
return; }
PDBENTRY SearchDatabase(PEVENTLOGRECORD pelrEvent)
{ DWORD i=0, j=0; char *szString = (char*)pelrEvent + pelrEvent->StringOffset;
for (;i<MAX_DB_EINTRIES && Database[i];i++) { if (pelrEvent->EventID==Database[i]->dwID) { for (;j<pelrEvent->NumStrings && !strcmp(szString,Database[i]->szStrings[j]); j++, szString+=strlen(szString)+1); } if (j==pelrEvent->NumStrings) { break; } }
return(Database[i]); }
PDBENTRY AddToDatabase( PEVENTLOGRECORD pelrEvent ) { DWORD i=0, j=0, dwBuffer=128, dwRegType; char *szString = (char*)pelrEvent + pelrEvent->StringOffset; HKEY hkServiceKey; char szKeyName[128], szMessageFile[128], *szDLLName, szDLLFullPath[128], *szParamStrings[MAX_SUB_STRINGS]; HINSTANCE hMessageFile;
for (;i<MAX_DB_EINTRIES && Database[i];i++);
if (i==MAX_DB_EINTRIES) { return(NULL); }
Database[i] = malloc(sizeof(DBENTRY));
Database[i]->dwID = pelrEvent->EventID; Database[i]->dwTimeFirst = pelrEvent->TimeGenerated; Database[i]->dwTimeLast = pelrEvent->TimeGenerated; Database[i]->dwNumStrings = pelrEvent->NumStrings; strncpy(Database[i]->szSource,(char*)pelrEvent+sizeof(EVENTLOGRECORD),64); for (;j<Database[i]->dwNumStrings;j++) { strncpy(Database[i]->szStrings[j],szString,MAX_SUB_STR_LEN); szString+=strlen(szString)+1; } Database[i]->dwCount = 1;
if (hRegistry == 0) { hRegistry = HKEY_LOCAL_MACHINE; if (bRemote) { if (!RegConnectRegistry(szRemoteComputer, HKEY_LOCAL_MACHINE, &hRegistry)) { //sprintf(sp,"EVENTDMP: Unable to open registry on remote computer %s ...ERROR: %d\n",
// szRemoteComputer, GetLastError());
//SplitPrint();
} } }
sprintf(szKeyName,"System\\CurrentControlSet\\Services\\EventLog\\System\\%s",Database[i]->szSource); if (RegOpenKeyEx(hRegistry,szKeyName,0,KEY_READ,&hkServiceKey)) { //sprintf(sp,"EVENTDMP: Unable to open EventLog service key on source: %s...\n",Database[i]->szSource);
//SplitPrint();
//sprintf(sp," ...Extended event description unavailable.");
//SplitPrint();
} else { if (RegQueryValueEx(hkServiceKey,"EventMessageFile", NULL, &dwRegType, szMessageFile, &dwBuffer)) { //sprintf(sp,"EVENTDMP: Unable to get message file value from registry on source: %s...\n",Database[i]->szSource);
//SplitPrint();
//sprintf(sp," ...Extended event description unavailable.");
//SplitPrint();
} else { szDLLName = strtok(szMessageFile,";\0"); for (j=0;j<Database[i]->dwNumStrings;j++) { szParamStrings[j]=(char *) Database[i]->szStrings[j]; }
while (szDLLName) { ExpandEnvironmentStrings(szDLLName, szDLLFullPath, 128); if (!(hMessageFile = LoadLibrary(szDLLFullPath))) { sprintf(sp,"EVENTDMP: Unable to load message file %s...\n",szDLLName); SplitPrint(); } else { #pragma warning( disable : 4090)
if (FormatMessage(FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_ARGUMENT_ARRAY, (LPCVOID)hMessageFile, Database[i]->dwID, 0, Database[i]->szDescription, MAX_DESC_LEN, szParamStrings)) { break; } #pragma warning( default : 4090 )
} FreeLibrary(hMessageFile); szDLLName = strtok(NULL,";\0"); } if (hMessageFile) FreeLibrary(hMessageFile); } } return(Database[i]); }
PDBENTRY UpdateDatabase(PEVENTLOGRECORD pelrEvent, PDBENTRY pdbEntry)
{ if (pdbEntry->dwID!=pelrEvent->EventID) return(NULL);
pdbEntry->dwCount++; if (pelrEvent->TimeGenerated < pdbEntry->dwTimeFirst) { pdbEntry->dwTimeFirst = pelrEvent->TimeGenerated; } if (pelrEvent->TimeGenerated > pdbEntry->dwTimeLast) { pdbEntry->dwTimeLast = pelrEvent->TimeGenerated; }
return(pdbEntry); }
void DumpDatabase(void)
{ DWORD i=0;
return; // Turn this off for now.
if (Database[i]) { sprintf(sp,"\n\n\nEVENTDMP:\n"); SplitPrint(); sprintf(sp," Red Event Statistics :\n"); SplitPrint(); while (Database[i]) { DWORD dwSecFirst = Database[i]->dwTimeFirst % 60; DWORD dwSecLast = Database[i]->dwTimeLast % 60; DWORD dwMinFirst = (Database[i]->dwTimeFirst % 3600)/60; DWORD dwMinLast = (Database[i]->dwTimeLast % 3600)/60; DWORD dwHourFirst = (Database[i]->dwTimeFirst % 86400)/3600; DWORD dwHourLast = (Database[i]->dwTimeLast % 86400)/3600; char szFirstTime[32]; char szLastTime[32];
sprintf(szFirstTime,"%2d:%02d:%02d",dwHourFirst,dwMinFirst,dwSecFirst); sprintf(szLastTime ,"%2d:%02d:%02d",dwHourLast ,dwMinLast ,dwSecLast );
sprintf(sp," %2d. EVENT SOURCE, ID : %s, %d\n",i+1,Database[i]->szSource, Database[i]->dwID & 0xffff); SplitPrint(); sprintf(sp," DESCRIPTION : %s",Database[i]->szDescription); SplitPrint(); sprintf(sp," OCCURENCES(FIRST/LAST) : %d (%s/%s)\n\n",Database[i]->dwCount,szFirstTime,szLastTime); SplitPrint(); i++; } } return; }
void PrintEventLogRecord( PEVENTLOGRECORD pelrEvent ) { DWORD j, EvId; char *szString; char szSource[64]; SYSTEMTIME LocalTime; DWORD EvType;
strncpy(szSource, (char*)pelrEvent+sizeof(EVENTLOGRECORD), sizeof(szSource));
EventLogTimeToLocalTime (pelrEvent->TimeWritten, &LocalTime);
if (bFirst) { printf("Fields are EVENT SOURCE, TIME, TYPE, ID, Tag \n"); bFirst = FALSE; }
printf("%6d : %-14s ", pelrEvent->RecordNumber, szSource);
FormatTime (&LocalTime); FormatDate (&LocalTime);
EvType = (DWORD) pelrEvent->EventType; if (EvType == EVENTLOG_SUCCESS) {szString = "Success"; } else if (EvType & EVENTLOG_ERROR_TYPE) {szString = "Error"; } else if (EvType & EVENTLOG_WARNING_TYPE) {szString = "Warn"; } else if (EvType & EVENTLOG_INFORMATION_TYPE) {szString = "Info"; } else if (EvType & EVENTLOG_AUDIT_SUCCESS) {szString = "AudSuccess"; } else if (EvType & EVENTLOG_AUDIT_FAILURE) {szString = "AudFail"; }
printf("%11s ", szString);
EvId = pelrEvent->EventID & 0xffff;
//
// Decode event ID based on Event log.
// ntfrs, System, Application, Security, DNS, DS
//
if (_stricmp("Directory Service", szLogType) == 0) { if ((_stricmp("esent", szSource) == 0)) { printf("%8d %s\n", EvId, JetIdToTag(EvId)); } else if ((_stricmp("NTDS ISAM", szSource) == 0)) { printf("%8d %s\n", EvId, JetIdToTag(EvId)); } else { printf("%8d %s\n", EvId, DirSvcEventIdToTag(EvId)); }
} else if (_stricmp("DNS Server", szLogType) == 0) { printf("%8d %s\n", EvId, GenIdToTag(EvId, DNSSvcEvents));
} else if (_stricmp("Application", szLogType) == 0) { if ((_stricmp("esent", szSource) == 0)) { printf("%8d %s\n", EvId, JetIdToTag(EvId)); } else if ((_stricmp("SceCli", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, SecPolicyEngine)); } else { printf("%8d\n", EvId); }
} else if (_stricmp("Security", szLogType) == 0) { printf("%8d\n", EvId);
} else if (_stricmp("System", szLogType) == 0) {
if ((_stricmp("Disk", szSource) == 0) || (_stricmp("scsiport", szSource) == 0) || (_stricmp("ftdisk", szSource) == 0)) { printf("%8d %s\n", EvId, SystemIoEventIdToTag(EvId)); } else
if ((_stricmp("netlogon", szSource) == 0)) { printf("%8d %s\n", EvId, NetLogonIdToTag(EvId)); } else
if ((_stricmp("print", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, PrinterEvents)); } else
if ((_stricmp("Windows File Protection", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, WindowsFileProtEvents)); } else
if ((_stricmp("dmio", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, DMIOEvents)); } else
if ((_stricmp("sam", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, SAMEvents)); } else
if ((_stricmp("kdc", szSource) == 0)) { printf("%8d %s\n", EvId, KDCIdToTag(EvId)); } else
if ((_stricmp("w32time", szSource) == 0)) { printf("%8d %s\n", EvId, TimeservIdToTag(EvId)); } else
if ((_stricmp("dhcp", szSource) == 0) || (_stricmp("DhcpServer", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, DHCPEvents)); } else
if ((_stricmp("rdr", szSource) == 0) || (_stricmp("NDIS", szSource) == 0) || (_stricmp("TrkSvr", szSource) == 0) || (_stricmp("tcpip", szSource) == 0) || (_stricmp("rdbss", szSource) == 0) || (_stricmp("mrxsmb", szSource) == 0) || (_stricmp("srv", szSource) == 0) || (_stricmp("Server", szSource) == 0) || (_stricmp("ipsec", szSource) == 0) || (_stricmp("EventLog", szSource) == 0) || (_stricmp("DCOM", szSource) == 0) || (_stricmp("Service Control Manager", szSource) == 0) || (_stricmp("dfs", szSource) == 0)) { printf("%8d %s\n", EvId, GenIdToTag(EvId, NetEvents)); } else { printf("%8d\n", EvId); }
} else if (_stricmp("ntfrs", szLogType) == 0) { if (strcmp("NtFrs", szSource) == 0) { printf("%8d %s\n", EvId, FrsEventIdToTag(EvId)); } else { printf("%8d\n", EvId); } }
if (pelrEvent->NumStrings > 0) {
printf("STRINGS: "); szString = (char*)pelrEvent + pelrEvent->StringOffset;
for (j=0; j<pelrEvent->NumStrings; j++) { if (j > 0) {printf(" | ");} printf("%s", szString); szString += strlen(szString)+1; } printf("\n"); } }
void CleanupDatabase(void)
{ DWORD i=0;
for (;i<MAX_DB_EINTRIES && Database[i];i++) free(Database[i]);
return; }
void Usage(void)
{ printf("USAGE:\n"); printf(" EventDmp [options]\n"); printf(" /r[:machine-name] - If included, this indicates the remote machine whose eventlog\n"); printf(" is to be read. The machine name should be in UNC format, i.e. \\\\G24.\n\n"); printf(" /l:logname - ntfrs, System, Application, Security, DNS, DS\n\n"); printf(" /n:nnnn - number of event log records to display (default: 200)\n"); printf(" /b[:pathname] - Backup eventlog before clearing. If <path> is included then the\n"); printf(" log will be backed up to the indicated path. Otherwise, the backup\n"); printf(" will reside in the current directory. Backup files take the form\n"); printf(" <[First letter of machine name][2 digit month][2 digit day][0-9].evt>.\n"); printf(" Backup files are not created by default.\n\n"); printf(" /c[:#] - Enables clearing of the log. If # is included, then the log is cleared\n"); printf(" every # hours. The default value is 24 hours. Log clearing is disabled\n"); printf(" by default.\n\n"); // printf(" /f:filename - Specifies a filter file. {This option is currently invalid}\n\n");
// printf(" /d:filename - Specifies a dump format file. {This option is currently invalid}\n\n");
// printf(" /o:{c,d,b} - Specifies output destination. The valid options are: \n");
// printf(" c = application console\n");
// printf(" d = debugger\n");
// printf(" b = both\n");
// printf(" Default condition is console\n");
printf(" /?, -?, /h, -h - This message.");
exit(0); return; }
|