Event ID 1031: Device … is no longer assigned to a guest partition
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
Device … is no longer assigned to a guest partition.
Event 1031
Kernel-PnP
System log
Information
Message and fields (as Event Viewer shows them)
Device … is no longer assigned to a guest partition.
The server detected a problem and has captured a live kernel dump to collect debug information.
Event 1031
SMBServer
SMBServer/Operational log
Warning
Message and fields (as Event Viewer shows them)
The server detected a problem and has captured a live kernel dump to collect debug information.
Reason: …
Dump Location: %SystemRoot%\LiveKernelReports
Guidance:
The server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected.
Stalled I/O
An I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity.