Skip to content

Event ID 1020: Read DNS Name Resolution Policy Table: Key Name …: DNSSEC Settings: DnsSecValidationRequired …, DnsQueryOverIPSec …, DnsEncryption … Direct Access Settings: DirectAccessServerList …, EnableRemoteIPSEC … RemoteEncryption … ProxyType … ProxyName

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Read DNS Name Resolution Policy Table: Key Name …: DNSSEC Settings: DnsSecValidationRequired …, DnsQueryOverIPSec …, DnsEncryption … Direct Access Settings: DirectAccessServerList …, EnableRemoteIPSEC … RemoteEncryption … ProxyType … ProxyName

Event 1020
DNS-Client
System log
Information
Message and fields (as Event Viewer shows them) 
Read DNS Name Resolution Policy Table: Key Name …: DNSSEC Settings: DnsSecValidationRequired …, DnsQueryOverIPSec …, DnsEncryption … Direct Access Settings: DirectAccessServerList …, EnableRemoteIPSEC …  RemoteEncryption … ProxyType … ProxyName …

A resource rebalance operation has succeeded.

Event 1020
Kernel-PnP
System log
Information
Message and fields (as Event Viewer shows them) 
A resource rebalance operation has succeeded.

Device Instance ID: …
Service Name: …
Device Count: …
Rebalance Phase: …
Subtree Root Instance ID: …
Subtree Includes Root: …
Rebalance Due to Dynamic Partitioning: …
Rebalance Reason: …
Conflicting Resource Type: …
Duration in Milliseconds: …
Device Reset: …

File system operation has taken longer than expected.

Event 1020
SMBServer
SMBServer/Operational log
Warning
Message and fields (as Event Viewer shows them) 
File system operation has taken longer than expected.

Client Name: …
Client Address: …
User Name: …
Session ID: …
Share Name: …
File Name: …
Command: …
Duration (in milliseconds): …
Warning Threshold (in milliseconds): …

Guidance:

The underlying file system has taken too long to respond to an operation. This typically indicates a problem with the storage and not SMB.