AD FS Auditing

25 events across 1 channel

Event ID	Title	Channel
299		Security
307		Security
309		Security
324		Security
403		Security
404		Security
410		Security
411		Security
412		Security
413		Security
431		Security
500		Security
501		Security
510		Security
1026		Security
1030		Security
1034		Security
1090		Security
1122		Security
1126		Security
1200		Security
1201		Security
1202		Security
1203		Security
1206		Security

Event ID 299 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 299,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632717,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_2": "https://testrp4.example.com/claims",
    "Binary": ""
  },
  "message": ""
}

Event ID 307 —

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 307,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606140,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_2": "ludus\\domainadmin",
    "Binary": ""
  },
  "message": ""
}

Event ID 309 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 309,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:03:42.728019+00:00",
    "event_record_id": 16595119,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_1": "ludus\\domainadmin",
    "Data_2": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : \r\n    ChannelMaxMessageSizeInBytes : 0\r\n",
    "Data_3": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : Data Source=np:\\\\.\\pipe\\microsoft##wid\\tsql\\query;Initial Catalog=AdfsConfigurationV4;Integrated Security=True\r\n    ChannelMaxMessageSizeInBytes : 20971520\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 324 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.247311+00:00",
    "event_record_id": 16621764,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "06aae50c-7a71-4208-a1b5-e4bd41408c7f",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "ludus\\domainadmin\r\n",
    "Data_3": "https://testrp1.example.com/saml",
    "Binary": ""
  },
  "message": ""
}

Event ID 403 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Data_8`	—
`Data_9`	—
`Data_10`	—
`Data_11`	—
`Data_12`	—
`Data_13`	—
`Data_14`	—
`Data_15`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.480193+00:00",
    "event_record_id": 16621720,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "d97c5901-104e-4ce1-a4f7-db055d721953",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "10.2.10.11",
    "Data_4": "GET",
    "Data_5": "/adfs/.well-known/openid-configuration",
    "Data_6": "-",
    "Data_7": "443",
    "Data_8": "10.2.10.11",
    "Data_9": "-",
    "Data_10": "0",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "False",
    "Data_15": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 404 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 404,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.570719+00:00",
    "event_record_id": 16621723,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "11a30859-37ab-4075-9ee9-df451c9ccf38",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "200",
    "Data_4": "OK",
    "Binary": ""
  },
  "message": ""
}

Event ID 410 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Data_8`	—
`Data_9`	—
`Data_10`	—
`Data_11`	—
`Data_12`	—
`Data_13`	—
`Data_14`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 410,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.495811+00:00",
    "event_record_id": 16621722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_1": "X-MS-Client-Application",
    "Data_2": "-",
    "Data_3": "X-MS-Client-User-Agent",
    "Data_4": "-",
    "Data_5": "client-request-id",
    "Data_6": "-",
    "Data_7": "X-MS-Endpoint-Absolute-Path",
    "Data_8": "/adfs/.well-known/openid-configuration",
    "Data_9": "X-MS-Forwarded-Client-IP",
    "Data_10": "-",
    "Data_11": "X-MS-Proxy",
    "Data_12": "-",
    "Data_13": "X-MS-ADFS-Proxy-Client-IP",
    "Data_14": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 411 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.815622+00:00",
    "event_record_id": 16621740,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_2": "fakeuser-The user name or password is incorrect",
    "Data_3": "System.IdentityModel.Tokens.SecurityTokenValidationException: fakeuser ---> System.ComponentModel.Win32Exception: The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   --- End of inner exception stack trace ---\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateTokenInternal(UsernameAuthenticationContext usernameAuthenticationContext, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)\r\n\r\nSystem.ComponentModel.Win32Exception (0x80004005): The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)",
    "Data_4": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 412 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 412,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621748,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 413 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 413,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.253084+00:00",
    "event_record_id": 16621769,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "ludus\\domainadmin\r\n",
    "Data_2": "-",
    "Data_3": "-",
    "Data_4": "https://testrp1.example.com/saml",
    "Data_5": "-",
    "Data_6": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 431 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 431,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.940716+00:00",
    "event_record_id": 16621755,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "-",
    "Data_2": "http://schemas.microsoft.com/idfx/keytype/bearer",
    "Data_3": "http://schemas.microsoft.com/idfx/requesttype/issue",
    "Data_4": "-",
    "Data_5": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 500 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Data_8`	—
`Data_9`	—
`Data_10`	—
`Data_11`	—
`Data_12`	—
`Data_13`	—
`Data_14`	—
`Data_15`	—
`Data_16`	—
`Data_17`	—
`Data_18`	—
`Data_19`	—
`Data_20`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 500,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632718,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod",
    "Data_2": "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant",
    "Data_4": "2026-03-13T23:09:23.704Z",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "-",
    "Data_8": "-",
    "Data_9": "-",
    "Data_10": "-",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "-",
    "Data_15": "-",
    "Data_16": "-",
    "Data_17": "-",
    "Data_18": "-",
    "Data_19": "-",
    "Data_20": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 501 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Data_8`	—
`Data_9`	—
`Data_10`	—
`Data_11`	—
`Data_12`	—
`Data_13`	—
`Data_14`	—
`Data_15`	—
`Data_16`	—
`Data_17`	—
`Data_18`	—
`Data_19`	—
`Data_20`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621749,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "Data_2": "ludus\\domainadmin",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
    "Data_4": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_5": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid",
    "Data_6": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_7": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_8": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_9": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_10": "S-1-1-0",
    "Data_11": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_12": "S-1-5-32-555",
    "Data_13": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_14": "S-1-5-32-573",
    "Data_15": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_16": "S-1-5-32-545",
    "Data_17": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_18": "S-1-5-32-554",
    "Data_19": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_20": "S-1-5-32-574",
    "Binary": ""
  },
  "message": ""
}

Event ID 510 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Data_8`	—
`Data_9`	—
`Data_10`	—
`Data_11`	—
`Data_12`	—
`Data_13`	—
`Data_14`	—
`Data_15`	—
`Data_16`	—
`Data_17`	—
`Data_18`	—
`Data_19`	—
`Data_20`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 510,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606141,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "Modify of a configuration object.\n\nConfiguration:\n    Type: ServiceSettings\n    Object ID: 863dfa3c-2755-4264-a651-e52ab76ff427\n    Name: ConfigurationSettings\n\n    Properties Replaced:\n        Property Name  : ServiceSettingsData\r\n        Property Value : \r\n            ServiceSettingsData\r\n                xmlns:i : http://www.w3.org/2001/XMLSchema-instance\r\n                xmlns : ",
    "Data_2": "http://schemas.datacontract.org/2012/04/ADFS\r\n                SecurityTokenService\r\n                    AdditionalEncryptionTokens\r\n                        CertificateReference\r\n                            IsChainIncluded\r\n                                false\r\n                            IsChainIncludedSpecified\r\n                                false\r\n                            FindValue\r\n      ",
    "Data_3": "                          01558C149B276D6BCECC61717C1291EB2EEFD21C\r\n                            RawCertificate\r\n                                ",
    "Data_4": "MIIE5DCCAsygAwIBAgIQWhuw5A0OGK5PnivlYq/ndzANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNBREZTIEVuY3J5cHRpb24gLSBhZGZzLmx1ZHVzLmRvbWFpbjAeFw0yNjAzMTMyMzAzNDVaFw0yNzAzMTMyMzAzNDVaMC4xLDAqBgNVBAMTI0FERlMgRW5jcnlwdGlvbiAtIGFkZnMubHVkdXMuZG9tYWluMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxTCUA/+UQOrvYAur7gQeLr+ShrHzQKWafQzKLxJmJlbcOQD2Lqk/+czQxbjkiwP1XDCXKC93ERf7Rjjd+nb4d2S8AysFOzfVUYyZM4WZ/trc4I3isb0pr8q9z4EV",
    "Data_5": "dL8l9zaKBJn4qYQYrk4oi6Wuue4MtZWDkSoxvyywk++TVvPDR+Cjy+wpKgPP2o3isCjahN4c6DYf0Cyc4QBqbgBdhUqidxPkYcQurqFr7Pd41wNsNk+SWthBFilaHzYfTZcL5cElqPjNtKauPhbwXLdV1H8lqB3AHk78wQ+OsGYNB4Vxylh+Ww6kTZjv1zH2r+Lvyj4WOFUX+01JfebeyjkGCMZRHQVYaD20kEWQ5zkv5dNcnl4vMDkbXovYm5PEz5kK7cNlQcsfMV903oh1BuBBWyOht5T0MV6qdPyLSRjdq3ylfWj4p8SgrwKHqzhp/WJYdoE/FyM3LNoFxajqTX+pf5HNFmfd4vekV/yye6z9KXXgVex9iU4UBl9RKBK2s8F6chuK4qUBHgP8",
    "Data_6": "8BlLVJoAshcMrOJcRy8TmxknyuPI0/MiCpZ6RtmuUr/yhtqc9s66vBF2nPibd5GVFu98eq1dhxEOmwSLlRmigRKXBYQOVXpM/XkiE7PyqT4iaCQwvBRB/91YvgOEPORMJjRzHcm7Je9tY5cQ4XfQ/Y0za/8519kCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAHBkYJW0/us0tQT7d+3UCpTppvK/Eu7cxvvC4zcvBLcsulg8Z1xdYOz0rnh/R83BhQ6WrChoS2Nimqk9YJurhXEGUo8X8BTVipQIM/sZ0Oz87W35VcEknCiVuGXfs9PdEQyA5Yg3F77J+qwoVkpWLObEWnzZMBSL7tc1jUOAXH+cClMBejvcylltwDPOBmBkOa1QOB2+A1DOOLsgX",
    "Data_7": "u1OCPG6bs+beIpinpULFVul4jhQi/Vui774xKLO7wIjxL7TGKPScmj8S9JvmrE4/YRVTFvllDAcIvi04kp1hjoj8wg63O4SUbnW2ysfQR1IXafIupHTNATzarIVJJEFRBYjwgczkcgolezzkcXx0uaTQw8J/ihuZHexyESx87Prf36PjpSyg7y4R7XlmBd3bHoxp+9fDmA/69Nm6v0sDEfpNYQ0xm5+Bc7mbtTpaUXsy49CB6FWp35xL6Plm/PFLnrhnT/tyXAgwDLeqcGkwYFkd6gJsQx/nYuYN7zRGz4kDnt/Vr3EdhAW4Wc9XD8Y4OTGHd3vBQbcPCfm2732R0gdtce2r42xvRXYSYZwS7AYqOWRupBbxmfMx6Fy4Ik/41M/Q6cHUIkZ/eB7j",
    "Data_8": "Kzxxvy0YKTSEc0hWOndcb/LDXiaB61WZu1ZW8YUy5SjQfZ2/ei+X70O6Z0F+nw8ITTei8ntTNG8=\r\n                            EncryptedPfx\r\n                                ",
    "Data_9": "AAAAAQAAAAAEEDEBQeN1uZlCqft6FErqM0wGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIC6Q+/c54AD4ScU7ZszEEhMO8+Gsl1aM3Gpq9H6M8Z1kBBCOOzSqGbXoD5gYdaS4I3lYIIIQoKp62gOK56pS/oApdd6cd9aADWn6Q9sBk7phR6G2s3l+vM3JYW4Lo9qgudOl/bEoCMZxTeymcSkNgzUMU+hiE4ilugl4uxUon9u185N+XuamuTyKBXsIxSUEAXRXWUSyccUdujvzA84gUFBknWc9499q3MOl/EcvKxSOjH+pqwNSQMH+8cJ97h1FTCOnApLnmYgEARpNmerlaE9x1LxVqVCnNiHLN8CNbkjgpR3VgFCTkZUEBubrDebd",
    "Data_10": "zuQYyPS+X+7uGwAIa3QsgW8rXGLw7CMxyxZD632hMBCrdDNEhko092JcjXjxU24MisINXOEwRueEKdXXHsBwpgzrxw9IAo2q2geJzdS4VLRPjFjey8Janxixv4alQahF0yfygDSFxDiBXckZJMThhIJxWhcgfJ593H9QgVon5AZT+LMimooTmoXxPuasd6DwF6IJmsPTZr4FxAB19ow5dPV3/deyAYTATBw+E1fYf6bfEhtNFLMPLgXI8tMdCN5FBhzYuOhSfLc9z7PMXD/zgDS94e2qAPGu+Kbe7d4tLsFG5YKOwdXJyTocA3qbJLv8tnxCEzJlT5c1dshiHwa1eqmJTzRxV7LweLqZ4HE8uLqVP+4i/O2ryeLjvTXpkuE2Q1nxWluY9R/hpRfp",
    "Data_11": "qI2zS4L6gks6+QdcHA2Io+4QvWpyw3wNpt3wzxR9PZeRTx0UwmCMDB6RVOp0x+sf6ryKpPAv0m6/zm5oYPtBbqM1wQCzEOBCTNnMTy1G43T2wZDIgygF7IQPK/h1Q3ih9e8RusQzOHukxeuVp8YqEERtCAUGdBsLbun9osYzRBpxVsSG/3aYiu7w4o+4dSwJ2hMi2T7h2yvnycHl4oKE1MvLFK/Cg8jZcNooiC7js0Bsln4BoSqAMh2HJ7nl7Io/TH5gJnrJUvMX+8JtSr7vlroKjINGzYbhwCyiWIYUf7TDx39evbx83mXAEFquczB//jzqBcRfk7yyqmQ+3X4A1Rvb4pmsjwFxCHwd4tdbVzjstQsDV9BbGBE4xUEcF8WwtIyECq1xRxYFX2rU",
    "Data_12": "JKES5wRp+R64ixTbpl9AugvdWkAQlkBh+TFCIKCK3qqSTt0fWjFG7WROs3RMJO4GbsWXV8vsMxHwtBpqO4TxtxSYmpgzD1aUSdXy+AWcYFF43xVy5IFZKAMEzt2QOKy5O5Gq23HidfF3PTOb+i8JCLhWk/QsMMRBlL6OTjT/kKY+ttDyY1Oo1V9yjqj1FHIjkQ7tuXa3E4N4LnQiz3L4sJfGoSt5QSfAjXjJJMtWcyy6QTyS5hF280oivwQ9DsfC3vgU2lj9JDKcqp/2ijvn22SEaa4wIejO0mSS4k46KS8cRE+0V68jJ7yY0knoQiXzESmbEIkEBt0bUT1tw0lqHucExj094rXx3r8oPw5R1+I7N5d0iSNDp8R1+Ic10giZFSof4eamQWq4nfzA",
    "Data_13": "NPu5+JbxokEnSdLm8ASwwlKdfRNtXUT+WAQhDE4PimppXcQd7JhyVVVu1s1O4abvjsuzUOuNeDhe5vW4YgNL+jE7GoVJsd5ypughNFLST9HkrCCmkp6LqY/CPEz2gZXwLTbDg8cv3tD+pJWG9N34wmTMvnKEGB3RZPTdWfWghUYN4JpdHRpK/YCkDjlkSJPyVwSRWU08kz+Qx2D2M07uEUBrGk5ArT27KBMfSHzd42SwmqHuMruJ26Ns92YTLMOk3sqSkDOiKVwxq7M7vcMHU8k7OVfGpmplJy3r+PLfpHHhFSMAA9L+eYLRTdcZRFlH7lmHnJPezK7c6FCUrq9EfZkW20P19RmshjZ020KEcMTz5k+7n8Tz8sF3Ggs6Z6EDgLpr/dwiDMi6390B",
    "Data_14": "XSwz0B5xn4ne+lSQ4ODl7BMXIgqkUSlzp5Scb8NluBIsXrXVsRK5ckWQJDPhw5kzL6A3M213+nWbJtXiyeHy7sV0t8CuROMJgk+Hl9QVg+WG3Ud3zDPRMWhwJOL2dqAwtBwTtTCTR8YIFoq1cX6nl0k7ng4mgnLzkomVSOD0JYYrSMQDEHEt+42WDR0Q0hUnQavDncbbcreXxXjeLk54B16bg/ucb/dFgL30bDC16qpJ9Hlh5fwUA2QYDf2+ZAR6wGVr/OSWaGG6GTbSYstKRKQ+CXqHp8gArNe4xR0PARYMtTUObGFCZ0vCpqguuSvTCjginfZdXbfCA2ONLsaamU3BXyYlCWpIJYP6ie8JQ66H87SJKlpNHE5uYZ+0+BMwpzCXlRjDHSdLUr8W",
    "Data_15": "DvQLrv5n+5IW4kbRod34UXv/dNGNgifUxDqRKEjkqiSS6fyqoczVbchriJg4ccn0RyGvlMT8StJ5NwOhxhkHUfR5LyTzGNK0aqInKlRVkCC8AifCQTqdRrGr7yuTg0FjrWh4FKEvXVdo/On3C/CAl5I3ExuXstVW0NLeWLKnBsLYhWCmo+YIQwBtgcghLnwz9LGroPw7ndEqTpLY1j4VUPlJw06NstWqCt8pYAmG1dwZXAHQfr2AHx7V5SlLzYcIjPo8YN1kQUf8Jb1+hh88VFOnq9hVgHZKL1vKARl1ENO/2F5jkpUqhjn2Rp2ydJUGYABN75cCtyqg87KbXNIXwanpqvwi1BiJQFSCyyoD3hV07mhL/2Q7NHgmjUsL/4SWO4BvoWmigVw7OYGL",
    "Data_16": "+4ovjQrbPApDhlenJv5UUmGMSRXk0vvdeOAm2ZmjZkvoGXygzF9lkkZd8b6wUDvIEzx8Q3FxjhgcCFrff1S+Ro4x7MaMq5A1OHKfEv9HHHRDrAy31ZKxkOmKJFSKsdO2NkZOs0gEqxPJLfAWKoMpzAs6n/JYLat6gu3WRL0ByiPscb8u4UUN8PbBgyrsWOQzsc27B/QA1WVX8k8yFbektCx40ynN2RVwVud4ymwgyt11+e0ApkmNvABZjI3TnAtbrCTujalsiTwcFuM/ulBqPJavdp/0ZOFU4ztMKxigucphfFwiHL14z5Khd1z6m9Uc0zslFWCoaIERGlwQBfLnEeOzrIW9Zw8jCvE6WtbuPa3P1gsA4G4nPYSy193eP7xX4SRvnEaqbCTFU/7C",
    "Data_17": "CvaTZyuiuKMQRD/+XOU7vKVs4fc1tMirHY+2AZDNE/+ngnh0ZaU69XoPBpJhSksJdgNhx7hrEaZDErQjkVlK5jsq8x9KEceN9ZYv+Jva4SnERhyXOX5S7fU1pt6Wso7/iv7CY/OdZAlvMpNyWCLUjz9Zq9CzpDG7iIWYpDK/dRK9gO8SmioUtXqB99GTGOAfyr3owC4zw1oV8zDu//n2rIP6NzlRgvsawMSuK1P0si1sw1Gq+e0hcHhyfbOYw6lAT2uw5BbXnPV3MmR2ksfrQwCDQXPZ0uVO8ZDdY5k74cBV1DBqxtlBOY3p+6YDZA1CxEmY849+ce1h0ZynsgdJyFRbTRuH7gjPkQDABcqq94HZ/bhh80inLBU8wNQNbRk/ssLftR9ykPIEV1tl",
    "Data_18": "+Um46B48tlZc442sS6WOipJHAYI7sZ1YJ1wK5ybZdDttlbdFFDxUQvIMIIK7PIEfGMG3dJiaL2m3HJFd9PTmm1+tf1V0Hab/ivMrlnjBQRnrYIYKtuctjY5TU3jUwgI9e8H7/yYhFFmcdAQ2VtasnD2Ri4q9qXXD617F4ERKaZ/sxbU6hgrCnJVg9yAG5mmgyVIQlpi0gy86nly/jQ/FwskF1spKpvtPsn2srixjJBaND2zHntL4pZsVdIyzDx2SGP5hGQY8rynH1jidLx2d5NZnwgcu1zlNxRuX8cwTGtbv2svSBlnVIZzEVtOLg8hM0Wx5/trs99DA+HjTFPupV1AX2sWSxdF5/wkRNmg52PINUUJ8RRIC+ayN42DVXPZVUqYvaVWghdTn6c5Y",
    "Data_19": "VG45kGQRlaDiNH7PYrY7UUUqokzavw7GFJnRBqMei7RSqlHGsUrjUBXw5E7FFkuqpqMyT4IKD8j9jvJFjakrDQpHC4Max4aM+G7Uh4VkmLwLADaEfVp+Umfq58FDyZnWQnhcYr+7I3mX/4ogPJxUiVjnFXLA3PsuVRPHV4Hb8EsFkHjXjNMQoXZ4cwu8DB97cUSJ+uBRFACwrilEqHlCi4xaehkpWkKO2t7uCDA2gvnQz2SrovexCjznaPl6srkCcxZqun2ZHWfB0n6FaN/9fQLTHtdEHB+7kFm8D1PyfPAJpuXHoW1YNCC7dnq53hMIC39All0EXjX9DnzZS+exY6culHwaFn/KXWmifl4osmfTYu0Z99xtA1vUFkOFQPQBXD2P4JnxsJ5BPT9c",
    "Data_20": "AUNkPEI6P3EqkyJ+eT5nZ0kh2/6uXLZgzQkN+oC3V9tqEQzLw2hdvA65QsMG9DtuuARNSPYb1l6P33DS+/tSFlr/m24cafoq9uX3XxW4LMMDXUQrIiFa7fZ5pMC7BFb3VkA6lYasPC+KvAptfVuOFMYVwugyOcDJz/OTCazMwQMjG5xi4I5cQRBaKzWPFl8hpd4B8HcLB5C502do8x1/6djUq6JayL7/u/v9FZvz5ZlF9+RRrES346r+x+un2wVS4zZcP2TSgfgf9TBfjAil2SEsV8VivQ/SXnNYT+GS5efxeM3xa5aAA5VGPIEErpE9kDVvqjHvJKGi2XpirDf5n65T/pVfrkYjMHah1qyg8I25q4KRamwHMdvVgUXBbXPcSBq7GAbXZclunUPK",
    "Binary": ""
  },
  "message": ""
}

Event ID 1026 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Data_6`	—
`Data_7`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.834431+00:00",
    "event_record_id": 16624207,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "2d2b5fdb-5717-4ed1-0300-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "fake",
    "Data_3": "https://localhost/cb",
    "Data_4": "-",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'fake'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthAccessTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1030 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.668865+00:00",
    "event_record_id": 16621734,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "nonexistent",
    "Data_4": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'nonexistent'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthClientCredentialsContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1034 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Data_4`	—
`Data_5`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1034,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.885864+00:00",
    "event_record_id": 16624228,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "e12e6b70-d9df-4a65-0600-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "fake",
    "Data_4": "-",
    "Data_5": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidRequestException: MSIS9380: The 'requested_token_use' parameter is not specified. The access token request must contain the 'requested_token_use' parameter for 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthOnBehalfOfContextBase.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1090 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1090,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:53.172704+00:00",
    "event_record_id": 16624277,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "33d19343-e8af-4588-0d00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "https://adfs.ludus.domain:443/adfs/userinfo",
    "Data_3": "Microsoft.IdentityServer.Web.Protocols.UserInfo.UserInfoMissingAccessTokenException: MSIS9914: Received invalid UserInfo request. Access token is not present in the request. The access token needs to be carried in Authorization Request Header Field or Form-Encoded Body Parameter.\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.ParseRequest(WrappedHttpListenerContext context)\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.OnGetContext(WrappedHttpListenerContext context)\r\n\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1122 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Data_3`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1122,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.211424+00:00",
    "event_record_id": 16624283,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 1126 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Data_2`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1126,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.142472+00:00",
    "event_record_id": 16624268,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "81f6458e-a9c1-4762-0c00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "<null>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1200 —

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1200,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>https://testrp4.example.com/claims</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>WsTrust</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1201 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1201,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.730824+00:00",
    "event_record_id": 16621737,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>N/A</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>OAuth</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/token</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1202 —

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1202,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.872525+00:00",
    "event_record_id": 16621752,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1203 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1203,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.818834+00:00",
    "event_record_id": 16621741,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>LUDUS\\fakeuser</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1206 —

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`	—
`Data_1`	—
`Binary`	—

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1206,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.223207+00:00",
    "event_record_id": 16624284,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"SignOutAudit\">\r\n  <AuditType>SignOut</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/logout</Endpoint>\r\n    </Component>\r\n    <Component xsi:type=\"SignOutAuditComponent\">\r\n      <SignedInRPs>\r\n        <SignedInRPs>N/A</SignedInRPs>\r\n      </SignedInRPs>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}