Event ID 1023: Name resolution policy table has been corrupted
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator. For more information: read policy table for rule … failed with error …
One or more shares present on this server have access based enumeration enabled.
Event 1023
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them)
One or more shares present on this server have access based enumeration enabled.
Guidance:
You should expect this event when enabling access-based enumeration on one or more shares by using either Server Manager or the Set-SmbShare Windows PowerShell cmdlet. Access-based enumeration can raise CPU utilization when clients connect to shares with folders containing many peer-level resources to which a user does not have access. You can control the CPU utilization by configuring the ABELevel value in the Windows registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\ABELevel [DWORD]
You can set the value for ABELevel to greater depths to minimize CPU overhead, but doing so diminishes the effectiveness of access-based enumeration:
Value = 0: access-based enumeration is enabled for all levels
Value = 1: access-based enumeration is enabled for a depth of 1 (example: \server\share)
Value = 2: access-based enumeration is enabled for a depth of 2 (example: \server\share\folder)
You can continue setting values for multiple depth levels.