Embedded Files
All commands run from Powershell (running as Administrator) unless indicated otherwise.
Get-ClusterDiagnosticInfo
Get-ClusterDiagnosticInfo
Get-ClusterDiagnosticInfo
Writing to path : C:\Users\mike\HealthTest\Script Version : 0.1Date of capture : 10/13/2026 20:16:21
<<< Phase 1 - Cluster Overview >>>
Getting Info for cluster .
Got Groups Resources
Got remainder cluster objects & exporting groups resources
Exporting remaining objects
Getting cluster propertiesWARNING: Cannot use winrm to connect to all up NodesWARNING: Cannot use winrm to connect to node NODE3WARNING: Only gathering a subset of logs, run command on every node to get all data<<< Phase 6 - Recent Error events >>>
Starting Export of Cluster Logs...Exporting Event Logs...Copying Event Logs....Processing Event Logs...Gathering System Info and Minidump files ...Receiving Cluster Logs...
Mode LastWriteTime Length Name---- ------------- ------ -----a---- 13/10/2026 20:17 67885370 NODE1.mydomain_cluster.log-a---- 13/10/2026 20:17 63849728 NODE2.mydomain_cluster.log-a---- 13/10/2026 20:17 51189818 NODE3.mydomain_cluster.logAll Logs Received
Summary of Error Events (in the last 24 hours) by LogName and EventId
LogName EventId N5 N6 Total Message------- ------- -- -- ----- -------Storage-Storport/Operational <549> 27 27 54 This is the first instance of the error seen during this time perio...Application <3041> 29 0 29 BACKUP failed to complete the command BACKUP LOG LIVE_AUTO_BOX. Che...SmbClient/Connectivity <30803> 14 0 14 Failed to establish a network connection....Storage-ClassPnP/Operational <507> 5 5 10 Completing a failed non-ReadWrite SCSI SRB requestSystem <10028> 5 3 8 DCOM was unable to communicate with the computer ukeq-cert002.parag...Application <13> 5 3 8 Certificate enrollment for mydomain\admin_wintelguy failed to enr...Application <6> 5 3 8 Automatic certificate enrollment for local system failed (0x800706b...Application <82> 5 3 8 Certificate enrollment for Local system failed in authentication to...Application <8198> 3 1 4 License Activation (slui.exe) failed with the following error code:...SmbClient/Connectivity <30800> 4 0 4 The server name cannot be resolved....Application <1000> 1 0 1 Faulting application name: dcconfig.exe, version: 1.0.0.0, time sta...Clustering-Manager/Admin <4657> 1 0 1 Failover Cluster PowerShell cmdlet Get-Cluster: You do not have adm...
<<< Phase 7 - Compacting files for transport >>>
Creating zip file with objects, logs and events.Cleaning up temporary directory C:\Users\mike\HealthTest\Zip File Name : C:\Users\mike\HealthTest-AGCLUSTER-20261013-2016.ZIP
<<< Phase 1 - Cluster Overview >>>
Getting Info for cluster .
Got Groups Resources
Got remainder cluster objects & exporting groups resources
Exporting remaining objects
Getting cluster propertiesWARNING: Cannot use winrm to connect to all up NodesWARNING: Cannot use winrm to connect to node NODE3WARNING: Only gathering a subset of logs, run command on every node to get all data<<< Phase 6 - Recent Error events >>>
Starting Export of Cluster Logs...Exporting Event Logs...Copying Event Logs....Processing Event Logs...Gathering System Info and Minidump files ...Receiving Cluster Logs...
Mode LastWriteTime Length Name---- ------------- ------ -----a---- 13/10/2026 20:17 67885370 NODE1.mydomain_cluster.log-a---- 13/10/2026 20:17 63849728 NODE2.mydomain_cluster.log-a---- 13/10/2026 20:17 51189818 NODE3.mydomain_cluster.logAll Logs Received
Summary of Error Events (in the last 24 hours) by LogName and EventId
LogName EventId N5 N6 Total Message------- ------- -- -- ----- -------Storage-Storport/Operational <549> 27 27 54 This is the first instance of the error seen during this time perio...Application <3041> 29 0 29 BACKUP failed to complete the command BACKUP LOG LIVE_AUTO_BOX. Che...SmbClient/Connectivity <30803> 14 0 14 Failed to establish a network connection....Storage-ClassPnP/Operational <507> 5 5 10 Completing a failed non-ReadWrite SCSI SRB requestSystem <10028> 5 3 8 DCOM was unable to communicate with the computer ukeq-cert002.parag...Application <13> 5 3 8 Certificate enrollment for mydomain\admin_wintelguy failed to enr...Application <6> 5 3 8 Automatic certificate enrollment for local system failed (0x800706b...Application <82> 5 3 8 Certificate enrollment for Local system failed in authentication to...Application <8198> 3 1 4 License Activation (slui.exe) failed with the following error code:...SmbClient/Connectivity <30800> 4 0 4 The server name cannot be resolved....Application <1000> 1 0 1 Faulting application name: dcconfig.exe, version: 1.0.0.0, time sta...Clustering-Manager/Admin <4657> 1 0 1 Failover Cluster PowerShell cmdlet Get-Cluster: You do not have adm...
<<< Phase 7 - Compacting files for transport >>>
Creating zip file with objects, logs and events.Cleaning up temporary directory C:\Users\mike\HealthTest\Zip File Name : C:\Users\mike\HealthTest-AGCLUSTER-20261013-2016.ZIP
Storage-Storport/Operational
Storage-Storport/Operational
Storage-Storport/Operational <549> 27 27 54 This is the first instance of the error seen during this time perio...
SmbClient/Connectivity
SmbClient/Connectivity
SmbClient/Connectivity <30803> 14 0 14 Failed to establish a network connection....SmbClient/Connectivity <30800> 4 0 4 The server name cannot be resolved....
Get-WinEvent -LogName "Microsoft-Windows-SmbClient/Connectivity" -MaxEvents 20 | fl TimeCreated,Message
TimeCreated : 13/10/2026 14:29:13Message : Failed to establish a network connection.
Error: The QUIC connection was idle.
Server name: mydevserver Server address: 10.92.195.131:443 Instance name: \Device\LanmanRedirector Connection type: Quic
Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
TimeCreated : 13/10/2026 14:29:03Message : Could not find a certificate mapping that matches the server name.
Connection type: Quic Server name: mydevserver.
TimeCreated : 13/10/2026 14:27:33Message : Failed to establish a network connection.
Error: {Device Timeout} The specified I/O operation on %hs was not completed before the time-out period expired.
Server name: myadserver Server address: 10.170.96.18:445 Instance name: \Device\LanmanRedirector Connection type: TCPIP
Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
Error: The QUIC connection was idle.
Server name: mydevserver Server address: 10.92.195.131:443 Instance name: \Device\LanmanRedirector Connection type: Quic
Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
TimeCreated : 13/10/2026 14:29:03Message : Could not find a certificate mapping that matches the server name.
Connection type: Quic Server name: mydevserver.
TimeCreated : 13/10/2026 14:27:33Message : Failed to establish a network connection.
Error: {Device Timeout} The specified I/O operation on %hs was not completed before the time-out period expired.
Server name: myadserver Server address: 10.170.96.18:445 Instance name: \Device\LanmanRedirector Connection type: TCPIP
Guidance: This indicates a problem with the underlying network or transport, such as with TCP/IP or QUIC/UDP, and not with SMB. A firewall that blocks TCP port 445 or UDP port 443 or TCP port 5445 when using an iWARP RDMA adapter can also cause this issue.
Check SQL Agent Jobs
Check SQL Agent Jobs
SELECT
j.name,
s.step_id,
s.step_name,
s.subsystem,
s.command
FROM msdb.dbo.sysjobs j
JOIN msdb.dbo.sysjobsteps s
ON j.job_id = s.job_id
WHERE s.command LIKE '%MYDEVSERVER%'
OR s.command LIKE '%MYADSERVER%'
OR s.command LIKE '%\\%'
ORDER BY j.name, s.step_id;
Run from SSMS or sqlcl
A badly configured SQL Agent job can generate exactly these events.
Consider jobs that:
A badly configured SQL Agent job can generate exactly these events.
Consider jobs that:
- Copy files
- Write backups
- Maintain scripts
- Export reports
- Use PowerShell
- Use CmdExec
SELECT
j.name,
h.run_date,
h.run_time,
h.run_status
FROM msdb.dbo.sysjobs j
JOIN msdb.dbo.sysjobhistory h
ON j.job_id = h.job_id
WHERE h.run_date = 20261013;
Check Windows File Shares
Check Windows File Shares
net use
Get-SmbMapping
Get-SmbConnection | ft ServerName,ShareName,UserName -Auto
Check SQL Linked Servers
Check SQL Linked Servers
SELECT *
FROM sys.servers;
Run from SSMS or sqlcl.Look for linked servers pointing at the servers listed in the log.
Check SQL Procedures
Check SQL Procedures
SELECT name
FROM sys.procedures
WHERE is_auto_executed = 1;
Run from SSMS or sqlcl.
Check Windows Scheduled Tasks
Check Windows Scheduled Tasks
Get-ScheduledTask
Application
Application
Could this be related to any of the Application errors?
Application
Application
Application <13> 5 3 8 Certificate enrollment for mydomain\admin_wintelguy failed to enr...Application <6> 5 3 8 Automatic certificate enrollment for local system failed (0x800706b...Application <82> 5 3 8 Certificate enrollment for Local system failed in authentication to...
Bibliography
Bibliography
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnosticshttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
https://learn.microsoft.com/en-us/powershell/module/smbsharehttps://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbmappinghttps://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbconnection
https://learn.microsoft.com/en-us/powershell/module/scheduledtaskshttps://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask
https://learn.microsoft.com/en-us/powershell/module/smbsharehttps://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbmappinghttps://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbconnection
https://learn.microsoft.com/en-us/powershell/module/scheduledtaskshttps://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask
Page updated
Google Sites
Report abuse