Windows Error & Event Code Explainer for SCADA Engineers

Type an error number (10060, 0x80070005, 1789), an event ID (7031, 1129, 4625) or a word, and get its meaning in plain language with the typical causes on a SCADA system and what to check — covering network, time, domain logon, services, disks, DCOM/OPC DA and TLS.

Search

1 of 89 entries.

10061 · WSAECONNREFUSEDWinSock · Windows Sockets

Connection refused

The device answered, but nothing accepts connections on that port (it replied with a TCP reset).

Typical causes
  • The service is stopped or not configured on the device (MMS, IEC 104 server, Modbus server)
  • Wrong port number
  • The device's client limit is reached
  • A firewall that rejects (rather than drops) the connection
What to check
  • Confirm the port (IEC 61850 MMS 102, IEC 104 2404, DNP3 20000, Modbus 502)
  • Check the service is enabled on the IED or gateway and how many clients it allows
  • On a Windows server, netstat -ano shows whether the port is LISTENING
Tool guide · know before you use

What this tool is, how it works and how far to trust it

A reference of the Windows error codes and event IDs most often met on SCADA servers, historians and engineering workstations, each explained with typical causes and what to check.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Find an entry by decimal or hex number, symbolic name or word; a Win32 code entered as 0x8007xxxx is found too.
  • Filter by area: network, time, domain logon, services and crashes, disk, DCOM/OPC DA, TLS, security, hardware.
  • Explain logon failure sub-status codes and Kerberos errors.

Why you need it

  • Problems first appear as an error number or an event ID; knowing what it means points straight at the cause.
  • Many codes look alike but mean opposite things (10060 timed out versus 10061 refused).

Understand this first

  • Event IDs are only unique together with their source: event 47 from Time-Service and event 47 from WHEA-Logger are different.
  • Some events are normal or harmless on their own (7036 service state change, many DCOM 10016); look at the time and the surrounding events.

What you need before you start

  • The error number or the event ID and source from Event Viewer (System, Application or Security log).
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Type the number exactly as shown, or a word from the message.
  • Check that the source of the entry matches the event's source in Event Viewer.
  • Read the causes and checks, and compare with the events logged at the same time.

What you get

  • Matching entries with meaning, typical causes on a SCADA system and what to check.

How to read the results

  • Use the 'what to check' list in order; the first items are the most common causes.
  • Correlate by time: a 7031 crash is explained by the Application Error 1000 logged a moment earlier.

Technical basis

  • Microsoft-documented Win32, HRESULT and Windows Sockets error codes; Windows event IDs of Service Control Manager, Kernel-Power, disk, Ntfs, Time-Service, GroupPolicy, NETLOGON, DistributedCOM, Schannel and Security auditing; Kerberos errors (RFC 4120).

Limits: when not to rely on it

  • A selection, not the complete Microsoft list. The event text and Microsoft's documentation remain the reference.
  • Vendor-specific SCADA application codes are not included.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13