Windows Event ID 32 – EventLog: File System Redirector

Open Event Viewer to examine the specific details of Event ID 32 occurrences.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 32 in the Event IDs field and click OK
5. Double-click any Event ID 32 entry to view detailed information
6. Check the General tab for event description and timestamp
7. Review the Details tab for additional system data

Use PowerShell to query recent Event ID 32 occurrences:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=32} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

Verify that file system services are running correctly and correlate with Event ID 32 timing.

1. Open Services console by pressing Windows + R, typing services.msc
2. Locate and examine these critical services:
   • Server - Supports file sharing over the network
   • Workstation - Creates and maintains client network connections
   • Distributed File System (DFS) Replication (if applicable)
3. Check service startup types and current status
4. Review service dependencies in the Dependencies tab

Use PowerShell to check file system related services:

Get-Service | Where-Object {$_.Name -match 'lanman|dfs|rdr|srv'} | Format-Table Name, Status, StartType, DisplayName -AutoSize

Query service startup correlation with Event ID 32:

$bootTime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$bootTime} | Where-Object {$_.Id -eq 32 -or $_.Id -eq 7036} | Sort-Object TimeCreated

Examine the complete file system initialization sequence to understand Event ID 32 context.

1. Open Device Manager by right-clicking This PC → Properties → Device Manager
2. Expand System devices and look for file system related entries
3. Check Storage controllers for any warning indicators
4. Review Network adapters if dealing with network file systems

Use PowerShell to examine file system drivers:

Get-WindowsDriver -Online | Where-Object {$_.ClassName -match 'System|Storage|Network'} | Format-Table Driver, ClassName, Version, Date

Check for file system filter drivers:

fltmc filters

Query system events around Event ID 32 timing:

$event32 = Get-WinEvent -FilterHashtable @{LogName='System'; Id=32} -MaxEvents 1
$startTime = $event32.TimeCreated.AddMinutes(-2)
$endTime = $event32.TimeCreated.AddMinutes(2)
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$startTime; EndTime=$endTime} | Sort-Object TimeCreated | Format-Table TimeCreated, Id, LevelDisplayName, ProviderName

For environments using network file systems, verify configuration and connectivity that affects the File System Redirector.

1. Open Command Prompt as Administrator
2. Check SMB client configuration:

   Get-SmbClientConfiguration

3. Verify network connectivity to file servers:

   Test-NetConnection -ComputerName [FileServerName] -Port 445

4. Review DFS configuration if applicable:

   Get-DfsnRoot

Check registry settings for file system redirector:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" | Format-List

Examine network provider order:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name ProviderOrder

Perform deep analysis of file system redirector behavior using advanced diagnostic tools.

1. Download and run Process Monitor from Microsoft Sysinternals
2. Set filters to capture file system activity:
   • Process Name: System
   • Operation: Process and Thread Activity
   • Path contains: redirector
3. Capture startup sequence and correlate with Event ID 32 timing

Examine detailed registry configuration:

$regPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation",
    "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer",
    "HKLM:\SYSTEM\CurrentControlSet\Services\Rdbss"
)

foreach ($path in $regPaths) {
    Write-Host "Registry Path: $path" -ForegroundColor Green
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | Format-List
    Write-Host "`n" -NoNewline
}

Enable detailed file system logging for troubleshooting:

wevtutil sl Microsoft-Windows-SMBClient/Audit /e:true
wevtutil sl Microsoft-Windows-SMBServer/Audit /e:true

Create custom event monitoring script:

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    Write-Host "Volume change detected: $($Event.DriveName)" -ForegroundColor Yellow
    Get-WinEvent -FilterHashtable @{LogName='System'; Id=32} -MaxEvents 1
}