AD FS Tracing
448 events across 2 channels
Event ID 39: task_039
#Message #
Fields #
| Name | Description |
|---|---|
genericString UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 39,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000080",
"time_created": "2026-06-02T05:04:51.525+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 11880
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"genericString": "Adding the following certificates to the AdfsTrustedDevices certificate store:\n"
},
"message": ""
}
Event ID 40: task_040
#Message #
Fields #
| Name | Description |
|---|---|
genericString UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 40,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000080",
"time_created": "2026-06-02T05:04:51.261+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 11880
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"genericString": "DeviceRegistrationCertificateUpdateBackgroundTask started."
},
"message": ""
}
Event ID 111: Began processing Rule.
#Description
Began processing Rule.
Message #
Fields #
| Name | Description |
|---|---|
rule UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 111,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000008",
"time_created": "2026-06-02T05:04:51.267+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 17332
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"rule": "@RuleName = \"Permit Service Account\"\r\nexists([Type == \"http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid\", Value == \"S-1-5-21-1006758700-2167138679-1475694448-1309\"])\r\n => issue(Type = \"http://schemas.microsoft.com/authorization/claims/permit\", Value = \"true\");\r\n"
},
"message": ""
}
Event ID 111: Began processing Rule:
#Description
Began processing Rule.
Fields #
| Name | Description |
|---|---|
rule UnicodeString |
Event ID 112: Finished processing rule
#Description
Finished processing rule.
Message #
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 112,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000008",
"time_created": "2026-06-02T05:04:51.267+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 17332
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 112: Finished processing rule
#Description
Finished processing rule.
Event ID 126: task_0126
#Message #
Fields #
| Name | Description |
|---|---|
genericString UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 126,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": "0x0000000001000000",
"time_created": "2026-06-02T05:04:51.299+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 1140
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"genericString": "Synchronization machine Role : PrimaryComputer"
},
"message": ""
}
Event ID 127: task_0127
#Message #
Fields #
| Name | Description |
|---|---|
genericString UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 127,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000001000000",
"time_created": "2026-06-02T05:04:51.261+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 1140
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"genericString": "calling sync on sync admin manager"
},
"message": ""
}
Event ID 128: Output claims included in details
#Description
Output claims included in details.
Message #
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 128,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000008",
"time_created": "2026-06-02T05:04:51.267+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 17332
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"claims": "ClaimType\thttp://schemas.microsoft.com/authorization/claims/permit\tValue\ttrue\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tLOCAL AUTHORITY\tOriginalIssuer\tLOCAL AUTHORITY\r\n\r\n"
},
"message": ""
}
Event ID 128: Output claims included in details
#Description
Output claims included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 129: Began processing policy for target: target.
#Event ID 129: Began processing policy for target:
#Description
Began processing policy for target.
Fields #
| Name | Description |
|---|---|
appliesTo UnicodeString | |
target UnicodeString | |
actAs Boolean | |
obo Boolean |
Event ID 130: Finished processing policy
#Description
Finished processing policy.
Event ID 131: Began processing authorization policy.
#Event ID 131: Began processing authorization policy
#Description
Began processing authorization policy.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString |
Event ID 132: Input claims included in details
#Event ID 132: Input claims included in details
#Description
Input claims included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 133: Authorization policy access check returned: checkAccessResult.
#Event ID 133: Authorization policy access check returned:
#Description
Authorization policy access check returned.
Fields #
| Name | Description |
|---|---|
checkAccessResult Boolean |
Event ID 134: Finished processing authorization policy
#Description
Finished processing authorization policy.
Message #
Event ID 134: Finished processing authorization policy
#Description
Finished processing authorization policy.
Event ID 135: Begin processing ActAs authorization policy.
#Event ID 135: Begin processing ActAs authorization policy
#Description
Begin processing ActAs authorization policy.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString |
Event ID 136: Finished processing ActAs authorization policy
#Description
Finished processing ActAs authorization policy.
Message #
Event ID 136: Finished processing ActAs authorization policy
#Description
Finished processing ActAs authorization policy.
Event ID 137: Began processing OnBehalfOf authorization policy.
#Event ID 137: Began processing OnBehalfOf authorization policy
#Description
Began processing OnBehalfOf authorization policy.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString |
Event ID 138: Finished processing OnBehalfOf authorization policy
#Description
Finished processing OnBehalfOf authorization policy.
Message #
Event ID 138: Finished processing OnBehalfOf authorization policy
#Description
Finished processing OnBehalfOf authorization policy.
Event ID 139: Input claims included in details
#Event ID 139: Input claims included in details
#Description
Input claims included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 140: Output claims included in details
#Event ID 140: Output claims included in details
#Description
Output claims included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 141: Began processing IdP issuance policy for caller identity.
#Event ID 141: Began processing IdP issuance policy for caller identity
#Description
Began processing IdP issuance policy for caller identity.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString | |
policySelector UnicodeString |
Event ID 142: Finished processing IdP issuance policy for caller identity
#Description
Finished processing IdP issuance policy for caller identity.
Message #
Event ID 142: Finished processing IdP issuance policy for caller identity
#Description
Finished processing IdP issuance policy for caller identity.
Event ID 143: Began processing RP issuance policy for effective caller identity.
#Event ID 143: Began processing RP issuance policy for effective caller identity
#Description
Began processing RP issuance policy for effective caller identity.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString | |
policySelector UnicodeString |
Event ID 144: Finished processing RP issuance policy for effective caller identity
#Description
Finished processing RP issuance policy for effective caller identity.
Message #
Event ID 144: Finished processing RP issuance policy for effective caller identity
#Description
Finished processing RP issuance policy for effective caller identity.
Event ID 145: Began processing IdP issuance policy for ActAs identity.
#Event ID 145: Began processing IdP issuance policy for ActAs identity
#Description
Began processing IdP issuance policy for ActAs identity.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString | |
policySelector UnicodeString |
Event ID 146: Finished processing IdP issuance policy for ActAs identity
#Description
Finished processing IdP issuance policy for ActAs identity.
Message #
Event ID 146: Finished processing IdP issuance policy for ActAs identity
#Description
Finished processing IdP issuance policy for ActAs identity.
Event ID 147: Began processing RP issuance policy for ActAs identity.
#Event ID 147: Began processing RP issuance policy for ActAs identity
#Description
Began processing RP issuance policy for ActAs identity.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString | |
policySelector UnicodeString |
Event ID 148: Finished processing RP issuance policy for ActAs identity
#Description
Finished processing RP issuance policy for ActAs identity.
Message #
Event ID 148: Finished processing RP issuance policy for ActAs identity
#Description
Finished processing RP issuance policy for ActAs identity.
Event ID 149: Began processing IdP issuance policy for OnBehalfOf identity.
#Event ID 149: Began processing IdP issuance policy for OnBehalfOf identity
#Description
Began processing IdP issuance policy for OnBehalfOf identity.
Fields #
| Name | Description |
|---|---|
policyType UnicodeString | |
policyData UnicodeString | |
policySelector UnicodeString |
Event ID 150: Finished processing IdP issuance policy for OnBehalfOf identity
#Description
Finished processing IdP issuance policy for OnBehalfOf identity.
Message #
Event ID 150: Finished processing IdP issuance policy for OnBehalfOf identity
#Description
Finished processing IdP issuance policy for OnBehalfOf identity.
Event ID 151: Evaluation context claims included in details
#Description
Evaluation context claims included in details.
Message #
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 151,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000008",
"time_created": "2026-06-02T05:04:51.267+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 17332
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"claims": "ClaimType\thttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\tValue\tludus\\svc_adfs\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tAD AUTHORITY\tOriginalIssuer\tAD AUTHORITY\r\n\r\nClaimType\thttp://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid\tValue\tS-1-5-21-1006758700-2167138679-1475694448-1309\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tAD AUTHORITY\tOriginalIssuer\tAD AUTHORITY\r\n\r\nClaimType\thttp://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid\tValue\tS-1-5-21-1006758700-2167138679-1475694448-513\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tAD AUTHORITY\tOriginalIssuer\tAD AUTHORITY\r\n\r\nClaimType\thttp://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid\tValue\tS-1-5-21-1006758700-2167138679-1475694448-513\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tAD AUTHORITY\tOriginalIssuer\tAD AUTHORITY\r\n\r\n\tValue\tS-1-1-0\r\n\r\n\tValue\tS-1-5-32-545\r\n\r\n\tValue\tS-1-5-32-554\r\n\r\n\tValue\tS-1-5-32-574\r\n\r\n\tValue\tS-1-5-6\r\n\r\n\tValue\tS-1-2-1\r\n\r\n\tValue\tS-1-5-11\r\n\r\n\tValue\tS-1-5-15\r\n\r\n\tValue\tS-1-5-80-2246541699-21809830-3603976364-117610243-975697593\r\n\r\n\tValue\tS-1-2-0\r\n\r\n\tValue\tS-1-18-1\r\n\r\nClaimType\thttp://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod\tValue\thttp://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tLOCAL AUTHORITY\tOriginalIssuer\tLOCAL AUTHORITY\r\n\r\nClaimType\thttp://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant\tValue\t2026-06-02T05:04:51.262Z\tValueType\thttp://www.w3.org/2001/XMLSchema#dateTime\tIssuer\tAD AUTHORITY\tOriginalIssuer\tAD AUTHORITY\r\n\r\nClaimType\thttp://schemas.microsoft.com/authorization/claims/permit\tValue\ttrue\tValueType\thttp://www.w3.org/2001/XMLSchema#string\tIssuer\tLOCAL AUTHORITY\tOriginalIssuer\tLOCAL AUTHORITY\r\n\r\n"
},
"message": ""
}
Event ID 151: Evaluation context claims included in details
#Description
Evaluation context claims included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 205: task_0205
#Message #
Fields #
| Name | Description |
|---|---|
genericString UnicodeString |
Example Event #
{
"system": {
"provider": "AD FS Tracing",
"guid": "{0457A490-4D4D-4A5B-B639-35382F1B6709}",
"event_source_name": "",
"event_id": 205,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": "0x0000000400000000",
"time_created": "2026-06-02T05:04:51.411+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3316,
"thread_id": 12844
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"genericString": "Heard heartbeat for JD-DC01-2022.ludus.domain, MaxBehaviorLevel = Max, nodeType = PrimaryComputer, "
},
"message": ""
}
Event ID 995: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
#Event ID 995: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data
#Description
Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
Fields #
| Name | Description |
|---|---|
originalEvent UnicodeString | |
originalDataIndex UInt32 | |
originalDataPageIndex UInt32 | |
originalData UnicodeString |
Event ID 996: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
#Event ID 996: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data
#Description
Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
Fields #
| Name | Description |
|---|---|
originalEvent UnicodeString | |
originalDataIndex UInt32 | |
originalDataPageIndex UInt32 | |
originalData UnicodeString |
Event ID 997: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
#Event ID 997: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data
#Description
Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
Fields #
| Name | Description |
|---|---|
originalEvent UnicodeString | |
originalDataIndex UInt32 | |
originalDataPageIndex UInt32 | |
originalData UnicodeString |
Event ID 998: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
#Event ID 998: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data
#Description
Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
Fields #
| Name | Description |
|---|---|
originalEvent UnicodeString | |
originalDataIndex UInt32 | |
originalDataPageIndex UInt32 | |
originalData UnicodeString |
Event ID 999: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
#Event ID 999: Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data
#Description
Data in the original trace event 'originalEvent' is logged individually in this event to prevent potential loss of data.
Fields #
| Name | Description |
|---|---|
originalEvent UnicodeString | |
originalDataIndex UInt32 | |
originalDataPageIndex UInt32 | |
originalData UnicodeString |
Event ID 1000: Input claims of calling principal included in details
#Event ID 1000: Input claims of calling principal included in details
#Description
Input claims of calling principal included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 1001: Input claims of OBO principal included in details
#Event ID 1001: Input claims of OBO principal included in details
#Description
Input claims of OBO principal included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Event ID 1002: Input claims of ActAs principal included in details
#Event ID 1002: Input claims of ActAs principal included in details
#Description
Input claims of ActAs principal included in details.
Fields #
| Name | Description |
|---|---|
claims UnicodeString |
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {0457A490-4D4D-4A5B-B639-35382F1B6709}
Defined in Microsoft.IdentityServer.NativeResources.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893 · sample captured from a live trace · binary version 5.00 · captured 2026-06-02
- WS2022-20348.4893 · schema read from the registered manifest · binary version 5.00 · captured 2026-06-02