NS_I_REBUILD_DISK 0X400D005F Fix: Not an Error

This isn't actually an error — it's an informational event from Windows Media Services. It logs when a NetShow administrator triggers a disk rebuild.

Quick Answer

Don't panic. Event ID 0X400D005F with source NS_I_REBUILD_DISK is an informational event logged by Windows Media Services (WMS) when a NetShow administrator manually starts rebuilding a disk cache or content store. It's not a failure — it's a notification that the rebuild process has begun. No action required unless the rebuild fails to complete.

What This Event Actually Means

Windows Media Services (the old name was NetShow Services — hence the prefix) uses disk-based storage for caching streaming content or storing on-demand media. When an admin runs the netsh wms rebuild disk command or clicks the rebuild button in the WMS management console, the service logs this event. The %1 placeholder in the message shows which admin account initiated the rebuild, and %2 shows the disk identifier. This event is strictly informational — it's the equivalent of a server logging "User X logged in".

The trigger is almost always someone on the admin team running a manual rebuild command. Either they're cleaning up stale cache files after migrating content, fixing a corrupted index, or preparing the server for a content refresh. If you see this event and nobody on your team remembers doing it, check your scheduled tasks or scripts — someone might have automated the rebuild.

Error codes in the 0X400xxxxx range are warnings or informational messages from WMS. They don't indicate a crash or service failure. The real issues you'd want to watch for are 0XC00Dxxxx errors, which point to actual problems like access denied or corrupted content.

Step-by-Step: Confirm and Monitor the Rebuild

Check the Event Details
Open Event Viewer and locate the event (Windows Logs > Application). Look at the description fields for the user account and disk name. This tells you who started it and what resource is being rebuilt.
Verify the Rebuild Status
Open the Windows Media Services management console (Start > Administrative Tools > Windows Media Services). Navigate to the server node. If a rebuild is running, you'll see a status message like "Rebuilding disk..." under the server's status column. You can also run this command to check:
```
netsh wms show server | find /i "rebuild"
```
If the output says "None pending", the rebuild already finished.
Wait for Completion
Disk rebuilds can take a few seconds to several hours depending on disk size and content count. Don't interrupt the process. If the rebuild hangs, force-stop it by running:
```
netsh wms stop
```
Then restart the WMS service: net start wmserver. Check the application log for any error events after the restart.
Review Scheduled Tasks
If the event appears repeatedly, check if someone set up a scheduled task to run netsh wms rebuild disk at intervals. Open Task Scheduler and look for tasks with "wms" or "netsh" in their names. If found, disable it unless you know why it's there.

Alternative Fixes If the Rebuild Fails

If the rebuild event logs but the server never reports completion (or throws a real error like 0XC00D000B), try these in order:

Restart the Windows Media Services service. This often clears transient state issues that block the rebuild. Run net stop wmserver && net start wmserver from an admin prompt.
Check for disk space. A rebuild requires free space equal to at least 10% of the content store size. If the drive is nearly full, the rebuild will fail silently. Free up space or move content to another volume.
Run a manual content index rebuild: netsh wms cache delete followed by netsh wms cache create. This forces a clean index, which can resolve corruption that blocks the normal rebuild process.
If the disk identifier references a removable drive or network share, verify that drive is present and accessible. WMS won't rebuild a missing disk.

Prevention: Keep This Event from Surprising You

Do three things:

Document any automated rebuild scripts in your change management system. If this event appears, you should be able to look up why it was scheduled.
Set an alert in your monitoring tool to ignore this specific event ID (0X400D005F) but flag it if it repeats more than 3 times in an hour — that could indicate a stuck loop.
If you're on Windows Server 2012 R2 or earlier, consider migrating to a modern streaming platform. WMS is deprecated, and these old informational events are a sign you're running legacy software that lacks support.

Bottom line: This event is a note, not a problem. Treat it like a log entry saying "we started the backup." Move on to more important things.