What does Windows error code 788 (ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED) mean?

ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED

delayed-write data was lost because the network connection disappeared.

ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED indicates this condition: Windows acknowledged or buffered file writes locally, but the remote path became unreachable before all dirty data reached the server. The application may have believed earlier writes completed unless it later checked flush or close results.

Where the result appears

• SMB file access over an interrupted LAN, VPN, Wi-Fi, or WAN connection.
• applications writing large files to mapped drives or UNC paths.
• offline-files and redirector paths during network failover.
• services closing a remote handle after the server session was torn down.

What to collect

• the full UNC path, server, share, and file handle lifecycle.
• network disconnect, SMB client, redirector, and transport events.
• results from FlushFileBuffers, close, fsync-equivalent, or application commit operations.
• whether the remote file size, checksum, and last-write time match the intended output.

Handling and recovery

Assume the remote file may be incomplete. Stop further dependent processing, reconnect, compare file length or checksum, and write a new verified copy rather than blindly appending. Applications requiring durability must check explicit flush and final close results and use an atomic publish pattern for important files.

Common misinterpretation

A successful buffered WriteFile return does not always prove that a remote server has committed the bytes. Delayed-write failure can surface later on flush, cleanup, or an unrelated I/O boundary.

References

• Microsoft: System error codes 500–999