Event ID 1001: The computer has rebooted from a bugcheck
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
The computer restarted after a blue screen (bug check); the stop code and its parameters are in the message, and a memory dump was saved.
What to check: Look up the stop code (e.g. 0x0000007E) for likely causes, and open the dump (C:\Windows\MEMORY.DMP or Minidump folder) with WinDbg !analyze -v to find the driver.
A client attempted to access the server using SMB1 and was rejected because SMB1 file sharing support is disabled or has been uninstalled.
Event 1001
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them)
A client attempted to access the server using SMB1 and was rejected because SMB1 file sharing support is disabled or has been uninstalled.
Guidance:
An administrator has disabled or uninstalled server support for SMB1. Clients running Windows XP / Windows Server 2003 R2 and earlier will not be able to access this server. Clients running Windows Vista / Windows Server 2008 and later no longer require SMB1. To determine which clients are attempting to access this server using SMB1, use the Windows PowerShell cmdlet Set-SmbServerConfiguration to enable SMB1 access auditing.