Event ID 1006: The computer has rebooted from a bugcheck
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
The Windows Resource Exhaustion Detector failed to stop due to an error.
Event 1006
Resource-Exhaustion-Detector
System log
Error
Message and fields (as Event Viewer shows them)
The Windows Resource Exhaustion Detector failed to stop due to an error.
The RD Session Host server received large number of incomplete connections.
The RD Session Host server received large number of incomplete connections. The system may be under attack.
… has detected malware or other potentially unwanted software.
Event 1006
Windows Defender
Windows Defender/Operational log
Warning
Message and fields (as Event Viewer shows them)
… has detected malware or other potentially unwanted software.
For more information please see the following:
…
Name: …
ID: …
Severity: …
Category: …
Path Found: …
Detection Type: …
Detection Source: …
Status: …
User: …\…
Process Name: …
Security intelligence Version: …
Engine Version: …
The share denied access to the client.
Event 1006
SMBServer
SMBServer/Operational log
Error
Message and fields (as Event Viewer shows them)
The share denied access to the client.
Client Name: …
Client Address: …
User Name: …
Session ID: …
Share Name: …
Share Path: …
Status: … (…)
Mapped Access: …
Granted Access: …
Security Descriptor: …
Guidance:
You should expect access denied errors when a principal accesses a share without the necessary permissions. Usually, this indicates that the principal does not have direct security permissions or lacks membership in a group that has direct access permissions. To determine and correct the permissions on the specified share, an administrator can use the Security tab in File Explorer Properties dialog, the SMBSHARE Windows PowerShell module, or the NET SHARE command. You can also use the Effective Access tab in File Explorer to help diagnose the issue.
Applications may generate access denied errors if they attempt to open files in a writable mode first, and then reopen the files in a read-only mode. In this case, no user action is required.
If access to the share is denied and this event is not logged, you can examine the file and folder NTFS/REFS permissions.
This error does not indicate a problem with authentication, only authorization.