You are currently offline, waiting for your internet to reconnect

Reason for System Event Log srv Event ID: 2012 - While transmitting or receiving data, the server encountered a network error.

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.


Consider the following scenario:

- You have a Windows Server 2012-based file server
- Windows Server 2003, Windows Server 2003 R2 or Microsoft Windows XP Professional-based client computers are accessing the file server with SMB v1 protocol
- or any other SMB v1 protocol based computer with 3rd party CIFS implementation is accessing the file server

In this scenario, you see multiple events with Source Srv ID 2012 in the system event log:

Log Name:      System
Source: srv
Date:          07.08.2013 10:23:04
Event ID: 2012
Task Category: None
Level: Warning
Keywords:      Classic
User:          N/A
Computer:      FILEsrv.fqdn
While transmitting or receiving data, the server encountered a network error. Occassional errors are expected, but large amounts of these indicate a possible error in your network configuration.  The error status code is contained within the returned data (formatted as Words) and may point you towards the problem.


In Words
0000: 00040000 002C0001 00000000 800007DC
0008: 00000000 C0000184 00000000 00000000
0010: 00000000 00000000 00000634

Explanation of these 'Words' logged in this event:
C0000184 = STATUS_INVALID_DEVICE_STATE , The device is not in a valid state to perform this request.
00000634 hex = 1588 decimal, this points to line 1588 in Windows Server 2012 code for downlevel Clients. 
This number depends on Operating System, Service Pack and possibly on SRV.SYS Hotfix level.

Frequently Asked Questions (FAQ):
Is such Srv 2012 an indicator for a serious error?
No this is a event of type WARNING, typically you can ignore it. See below for some typical scenarios, where such Event is expected.
Administrators should just ignore the warning.

What should a normal SMB communication look like?
According to CIFS protocol specification (

After upgrading our file server to Windows Server 2012 we encounter this Event more often, why?
- you have an environment with many downlevel SMB1 clients like Windows XP or Windows Server 2003.
Unsuccessfull logon attempts (SESSION SETUP Resonse with error status) followed by TCP FIN result in Event 2012.
These clients tend to end their last SMB session with a LOGOFF and TREE DISCONNEcT SMB command, then they terminate the transport session gracefully with a TCP FIN.
This sequence of SMB commands is not fully CIFS compliant, see above, resulting in Event 2012.

- you have an environment with some SAMBA / UNIX / MAC based downlevel SMB1 clients.
These clients often terminate SMB sessions not CIFS conform (omitting a LOGOFF command), resulting in Event 2012.

- downlevel clients with redirected folders on the Windows Server 2012-based file server are disconnected from the network without a proper shutdown.
The file server sends in such situation TCP KeepAlive packets to inactive clients and resets the TCP transport connection if there is no more response from the client.

- SMB1 clients encounter some network problems (File server is not answering their outstanding SMB command within one minute (SessTimeout = 60 sec), so the client won't send a LOGOFF, but termiates the TCP session with RESET and then establishes a new TCP / SMB session with a new virtual circuit (VcNumber: 0).
The file server was not aware of the clients network issue and scavenges the former client session as soon as it detects the same SMB1 client IP with SESSION SETUP (VcNumber: 0) coming in.
(this can happen in NAT Scenario for different clients resulting in same IP address in the file server subnet as well)
More information
For more information about this topic, click the following article number to view the article on the Microsoft Web:

[MS-CIFS]: Common Internet File System (CIFS) Protocol

907546 Event ID 2012 is logged when you try to access files on a Server Message Block (SMB) file share that resides on a Windows 2000 SP4-based computer

SMB1, SMBv1, SMB version1, Riverbed Steelhead WAN optimizer, WAN accelerator,
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Article ID: 2885205 - Last Review: 09/02/2013 15:38:00 - Revision: 4.0

Windows Server 2012 Datacenter, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2012 Standard, Microsoft Hyper-V Server 2012, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Foundation, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Standard, Microsoft Windows Server 2003 Service Pack 2

  • KB2885205