Event ID 2025 — Shared Folders (SMB) Server Service Availability

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

yellow

The Server Message Block (SMB) protocol is what Windows uses to share files, printers, serial ports, and communicate this information between computers. The service must be running for the server to identify and share resources.

Event Details

Product: Windows Operating System
ID: 2025
Source: Server
Version: 6.1
Symbolic Name: EVENT_SRV_DOS_ATTACK_DETECTED
Message: The server has detected an attempted Denial-Of-Service attack from client %2, and has disconnected the connection.

Resolve

Security Alert - Review client or network usage

Denial of service (DoS) attacks are network attacks that are aimed at making a computer or a particular service on a computer unavailable to network users. It is important that you determine if the server is experiencing a DoS attack. For more information to help you understand network security and DoS attacks, see the Microsoft Security Central website at http://www.microsoft.com/security.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify the Shared Folder (SMB) server is available:

  1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type net config server.
  3. Verify that NetbiosSmb appears under the Server is active on section in the results.

Related Management Information

Shared Folders (SMB) Server Service Availability

File Services

Community Additions

ADD
Show: