Microsoft-Windows-AAD

204 events across 2 channels

Event ID	Title	Channel
1001	AadCloudAPPlugin Initialize Start	Analytic
1002	AadCloudAPPlugin Initialize Stop.	Analytic
1003	AadCloudAPPlugin Uninitialize Start	Analytic
1004	AadCloudAPPlugin ValidateUserInfo Start	Analytic
1005	AadCloudAPPlugin ValidateUserInfo Stop.	Analytic
1006	AadCloudAPPlugin GetToken Start	Analytic
1007	AadCloudAPPlugin GetToken Stop.	Analytic
1008	AadCloudAPPlugin GetKeys Start	Analytic
1009	AadCloudAPPlugin GetKeys Stop.	Analytic
1010	AadCloudAPPlugin GetUnlockKey Start	Analytic
1011	AadCloudAPPlugin GetUnlockKey Stop.	Analytic
1012	AadCloudAPPlugin PersistSSOTokens Start	Analytic
1013	AadCloudAPPlugin PersistSSOTokens Stop.	Analytic
1015	AadCloudAPPlugin Realm discovery response.	Analytic
1016	AadCloudAPPlugin device is cloud domain joined	Analytic
1017	AadCloudAPPlugin device is domain joined	Analytic
1018	AadCloudAPPlugin GetToken Correlation ID.	Analytic
1019	AadCloudAPPlugin GetKeys Correlation ID.	Analytic
1020	AadCloudAPPlugin loaded as surrogate	Analytic
1021	AadCloudAPPlugin MEX request status.	Analytic
1022	Endpoint Uri.	Analytic
1023	NGC UserID Key.	Analytic
1024	Http request status.	Operational
1025	Http request status.	Operational
1026	Credential type: %1 Correlation ID: %2.	Analytic
1027	AadCloudAPPlugin managed logon flow for federated NGC user.	Analytic
1028	AadCloudAPPlugin RefreshToken Start	Analytic
1029	AadCloudAPPlugin RefreshToken Stop.	Analytic
1030	AadCloudAPPlugin RefreshToken Correlation ID.	Analytic
1031	AadCloudAPPlugin encrypted OAuth response received	Analytic
1032	Number of groups received.	Analytic
1033	Validation needed.	Analytic
1034	AadCloudAPPlugin GenericCallPkg Start	Analytic
1035	AadCloudAPPlugin GenericCallPkg Stop.	Analytic
1081	OAuth response error: %1 Error description: %2 CorrelationID: %3.	Operational
1082	Key error: %1 Error description: %2 CorrelationID: %3.	Operational
1083	Protected key error: %1 Error description: %2 CorrelationID: %3.	Operational
1084	Http transport error.	Operational
1085	Logon failure.	Operational
1086	Get user realm failure.	Operational
1087	Get credential keys failure.	Operational
1088	WSTrust response error: %1 Error description: %2.	Operational
1089	Device is not cloud domain joined.	Operational
1090	NGC nonce response error: %1 Error description: %2 CorrelationID: %3.	Operational
1091	NGC auth ticket is not defined.	Operational
1092	OAuth request retry.	Operational
1093	NGC call %1 returned error: %2.	Operational
1094	Refresh token failure.	Operational
1095	Refresh token user SIDs don't match.	Operational
1096	Refresh token is expired.	Operational
1097	Error: %1 %2 %3.	Operational
1098	Error: %1 %2 %3.	Operational
1099	Code: %1 %2 %3.	Analytic
1100	Error: %1 %2 %3.	Operational
1101	Error: %1 %2 %3.	Operational
1102	Code: %1 %2 %3.	Analytic
1103	Can't decrypt OAuth response.	Operational
1104	AAD Cloud AP plugin call %1 returned error: %2.	Operational
1105	Device registration API call %1 returned error: %2.	Operational
1106	Number of security groups received %1.	Operational
1107	Error: %1 %2 %3.	Analytic
1108	Error: %1 %2 %3.	Analytic
1109	Error: %1 %2 %3.	Analytic
1110	Error: %1 %2 %3.	Analytic
1111	Error: %1 %2 %3.	Operational
1112	Error: %1 %2 %3.	Operational
1113	Code: %1 %2 %3.	Analytic
1114	Error: %1 %2 %3.	Analytic
1115	Error: %1 %2 %3.	Analytic
1116	Get Enterprise STS OAuth Info failure.	Operational
1117	Enterprise STS Refresh token failure.	Operational
1118	Enterprise STS Logon failure.	Operational
1119	Enterprise STS OAuth Info response.	Analytic
1120	Enterprise STS Refresh token is expired.	Operational
1121	Enterprise STS RefreshToken Correlation ID.	Analytic
1122	Refresh token subject don't match.	Operational
1123	AadCloudAPPlugin smart card logon for non-federated user.	Operational
1124	Device is DRS joined but Enterprise STS is disabled.	Operational
1125	AadCloudAPPlugin loaded as surrogate, no key recovery	Analytic
1126	AadCloudAPPlugin device is Enterprise joined	Analytic
1127	AadCloudAPPlugin device P2P certificate update thread started	Analytic
1128	AadCloudAPPlugin device P2P certificate update thread stopped	Analytic
1129	AadCloudAPPlugin Uninitialize Stop	Analytic
1130	AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID.	Analytic
1131	Update P2P device certificate failure.	Operational
1132	AadCloudAPPlugin GetCertificateFromCred Correlation ID.	Analytic
1133	Update P2P user certificate failure.	Operational
1134	AAD Cloud AP plugin call %1 returned error: %2.	Analytic
1135	AadCloudAPPlugin RenewCertificate Correlation ID.	Analytic
1136	AadCloudAPPlugin AcceptPeerCertificate Start	Analytic
1137	AadCloudAPPlugin AcceptPeerCertificate Stop.	Analytic
1138	AadCloudAPPlugin RenewCertificate Start	Analytic
1139	AadCloudAPPlugin RenewCertificate Stop.	Analytic
1140	AadCloudAPPlugin GetCertificateFromCred Start	Analytic
1141	AadCloudAPPlugin GetCertificateFromCred Stop.	Analytic
1142	Get token user names don't match.	Operational
1143	Generic Call Package call type.	Analytic
1144	Realm discovery for: %2 authority: %3 fallback domain hint: %4 useUpn: %1.	Analytic
1145	AAD Cloud AP plugin token needs refresh reason.	Analytic
1146	Token is not refreshed.	Analytic
1147	AadCloudAPPlugin AssembleOpaqueData Start	Analytic
1148	AadCloudAPPlugin AssembleOpaqueData Stop.	Analytic
1149	AadCloudAPPlugin DisassembleOpaqueData Start	Analytic
1150	AadCloudAPPlugin DisassembleOpaqueData Stop.	Analytic
1151	AadCloudAPPlugin P2P device certificate update error.	Operational
1152	AadCloudAPPlugin device certificate key error.	Operational
1153	AadCloudAPPlugin device certificate not available for logon.	Operational
1154	Password expiration claims.	Analytic
1155	Logon with session key failure.	Operational
1156	Password expiration fields.	Analytic
1157	AadCloudAPPlugin PostLogonProcessing Start	Analytic
1158	AadCloudAPPlugin PostLogonProcessing Stop.	Analytic
1159	AadCloudAPPlugin S2U logon failed.	Operational
1160	Logon failure.	Operational
1161	Logon failure.	Operational
1162	Logon failure.	Operational
1163	Logon failure.	Operational
1164	Logon failure.	Operational
1165	Logon failure.	Operational
1200	BrowserCore operation started	Analytic
1201	BrowserCore operation completed successfully	Analytic
1202	BrowserCore operation completed with a failure.	Operational
1203	BrowserCore inner operation %2 completed with error: %1.	Operational
1204	AadCloudAPPlugin LookupSIDFromIdentityName Start	Analytic
1205	AadCloudAPPlugin LookupSIDFromIdentityName Stop.	Analytic
1206	AadCloudAPPlugin LookupIdentityFromSIDName Start	Analytic
1207	AadCloudAPPlugin LookupIdentityFromSIDName Stop.	Analytic
1208	AadCloudAPPlugin LookupSIDFromIdentity Identity: %1 Correlation ID: %2.	Analytic
1209	AadCloudAPPlugin LookupIdentityFromSID SID: %1 Correlation ID: %2.	Analytic
1210	AadCloudAPPlugin password expired, password change URI.	Operational
1211	Writing RunRecovery registry value failed.	Operational
1212	Enterprise logon.	Operational
1213	WamExtension process token operation started	Analytic
1214	WamExtension process token operation completed successfully	Analytic
1215	WamExtension process token operation completed with error.	Operational
1216	WamExtension device authentication call status: %1 Correlation ID: %2.	Analytic
1217	Get device token.	Analytic
1218	StartFidoAuthenticationSession start	Analytic
1219	StartFidoAuthenticationSession stop.	Analytic
1220	CloseFidoAuthenticationSession start	Analytic
1221	CloseFidoAuthenticationSession stop.	Analytic
1222	GetClientData start	Analytic
1223	GetClientData stop.	Analytic
1224	SignClientDataFido start	Analytic
1225	SignClientDataFido stop.	Analytic
1226	ChangePin start	Analytic
1227	ChangePin stop.	Analytic
1228	GetSerializedAuthBuffer start	Analytic
1229	GetSerializedAuthBuffer stop.	Analytic
1230	AuthHelper call %1 returned error: %2.	Operational
1231	AadCloudAPPlugin Resource infomation.	Analytic
1232	AadCloudAPPlugin RBAC authorization code response.	Analytic
1233	AadCloudAPPlugin User access control role.	Analytic
1234	AadCloudAPPlugin using resource id from the Idtoken.	Analytic
1235	RBAC Status: %1 Correlation ID: %2.	Analytic
1236	Failed to create the resource id	Analytic
1237	Device is configured for RBAC authorization	Operational
1238	Not sending the client certificate as it is optional on the server	Analytic
1239	Doing RBAC logon	Analytic
1240	Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate	Analytic
1241	On-prem tgt error.	Operational
1242	Added user to admins security group	Analytic
1243	Removed user from admins security group	Analytic
1244	Security groups were not loaded.	Operational
1245	Security groups were not updated.	Operational
1246	User sid: %1 Group sids: %2.	Analytic
1247	RunRecovery registry value successfully written.	Operational
1248	AuthHelper auth buff local nonce	Operational
1249	Cloud tgt error.	Operational
1250	DoGetToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: %3 …	Operational
1251	DoGetEnterpriseToken Diagnostic Event: Result: %1 User Identity: %2 Credential …	Operational
1252	DoRefreshToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: …	Operational
1253	DoRefreshEnterpriseToken Diagnostic Event: Result: %1 User Identity: %2 …	Operational
1254	Response content type.	Analytic
1255	AD TGT: %1 Cloud TGT: %2.	Analytic
1256	P2P certificate update error.	Operational
1257	Credbuffer correlation ID: %1 Correlation ID: %2.	Analytic
1258	CA cert hash (keyID): %1 Correlation ID: %2.	Analytic
1259	CA certificate update error.	Operational
1260	RetryGetClientData start	Analytic
1261	RetryGetClientData stop.	Analytic
1262	Binding key tag check failed.	Operational
1263	BrowserCore inner operation %2 with account pairwiseID %1 not found error.	Operational
1264	Token binding key created.	Analytic
1265	WamExtension preprocess token operation started.	Analytic
1266	WamExtension preprocess token operation completed successfully	Analytic
1267	WamExtension preprocess token operation completed with error.	Operational
1268	WamExtension postprocess token operation started.	Analytic
1269	WamExtension postprocess token operation completed successfully.	Analytic
1270	WamExtension postprocess token operation completed with error.	Operational
1271	Token binding claim(s) included in the request.	Analytic
1272	Token binding key is not healthy and needs to be re-created.	Analytic
1273	Token binding claims need to be re-generated due to changes in attestation …	Analytic
1274	Token binding claims generated.	Analytic
1275	Token binding claims generated for UI request.	Analytic
1276	Token binding claims count.	Analytic
1277	KeyGuard availability detection failed.	Operational
1278	KeyGuard with attestation support is not detected.	Operational
1279	Token binding claims of type %1 could not be generated because AIK does not …	Analytic
1280	PRT session key needs to be rolled.	Operational
1281	Token binding key deleted.	Analytic
1282	SHR property in request is not allowed.	Operational
1283	Invalid registry value was ignored.	Analytic
1284	Token binding claims need to be re-generated as cached claims were generated for …	Analytic

Event ID 1001 — AadCloudAPPlugin Initialize Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Initialize Start

Event ID 1002 — AadCloudAPPlugin Initialize Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Initialize Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1003 — AadCloudAPPlugin Uninitialize Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Uninitialize Start

Event ID 1004 — AadCloudAPPlugin ValidateUserInfo Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin ValidateUserInfo Start

Event ID 1005 — AadCloudAPPlugin ValidateUserInfo Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin ValidateUserInfo Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1006 — AadCloudAPPlugin GetToken Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetToken Start

Event ID 1007 — AadCloudAPPlugin GetToken Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetToken Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1008 — AadCloudAPPlugin GetKeys Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetKeys Start

Event ID 1009 — AadCloudAPPlugin GetKeys Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetKeys Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1010 — AadCloudAPPlugin GetUnlockKey Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetUnlockKey Start

Event ID 1011 — AadCloudAPPlugin GetUnlockKey Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetUnlockKey Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1012 — AadCloudAPPlugin PersistSSOTokens Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin PersistSSOTokens Start

Event ID 1013 — AadCloudAPPlugin PersistSSOTokens Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin PersistSSOTokens Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1015 — AadCloudAPPlugin Realm discovery response.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Realm discovery response: %1.
Request status: %2

Fields

Name	Description
`AadCloudAPPlugin_Realm_discovery_response`	—
`Request_status`	—
`Response`	—
`Status`	—

Event ID 1016 — AadCloudAPPlugin device is cloud domain joined

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin device is cloud domain joined

Event ID 1017 — AadCloudAPPlugin device is domain joined

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin device is domain joined

Event ID 1018 — AadCloudAPPlugin GetToken Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetToken Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_GetToken_Correlation_ID`	—
`value`	—

Event ID 1019 — AadCloudAPPlugin GetKeys Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetKeys Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_GetKeys_Correlation_ID`	—
`value`	—

Event ID 1020 — AadCloudAPPlugin loaded as surrogate

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin loaded as surrogate

Event ID 1021 — AadCloudAPPlugin MEX request status.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin MEX request status: %1

Fields

Name	Description
`AadCloudAPPlugin_MEX_request_status`	—
`Status`	—

Event ID 1022 — Endpoint Uri.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Endpoint Uri: %1

Fields

Name	Description
`Endpoint_Uri`	—
`value`	—

Event ID 1023 — NGC UserID Key.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

NGC UserID Key: %1

Fields

Name	Description
`NGC_UserID_Key`	—
`value`	—

Event ID 1024 — Http request status.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Http request status: %1

Fields

Name	Description
`Http_request_status`	—
`value`	—

Event ID 1025 — Http request status.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Http request status: %1. Method: %2 Endpoint Uri: %3 Correlation ID: %4

Fields

Name	Description
`Http_request_status`	—
`Method`	—
`Endpoint_Uri`	—
`Correlation_ID`	—
`value`	—
`EndpointUri`	—
`CorrelationID`	—

Event ID 1026 — Credential type: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Credential type: %1 Correlation ID: %2

Fields

Name	Description
`Credential_type`	—
`Correlation_ID`	—
`value`	—
`CorrelationID`	—

Event ID 1027 — AadCloudAPPlugin managed logon flow for federated NGC user.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin managed logon flow for federated NGC user.

Event ID 1028 — AadCloudAPPlugin RefreshToken Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RefreshToken Start

Event ID 1029 — AadCloudAPPlugin RefreshToken Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RefreshToken Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1030 — AadCloudAPPlugin RefreshToken Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RefreshToken Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_RefreshToken_Correlation_ID`	—
`value`	—

Event ID 1031 — AadCloudAPPlugin encrypted OAuth response received

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin encrypted OAuth response received

Event ID 1032 — Number of groups received.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Number of groups received: %1

Fields

Name	Description
`value`	—

Event ID 1033 — Validation needed.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Validation needed: %1

Fields

Name	Description
`Validation_needed`	—
`value`	—

Event ID 1034 — AadCloudAPPlugin GenericCallPkg Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GenericCallPkg Start

Event ID 1035 — AadCloudAPPlugin GenericCallPkg Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GenericCallPkg Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1081 — OAuth response error: %1 Error description: %2 CorrelationID: %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

OAuth response error: %1
Error description: %2
CorrelationID: %3

Fields

Name	Description
`OAuth_response_error`	—
`Error_description`	—
`CorrelationID`	—
`Error`	—
`ErrorDescription`	—

Event ID 1082 — Key error: %1 Error description: %2 CorrelationID: %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Key error: %1
Error description: %2
CorrelationID: %3

Fields

Name	Description
`Key_error`	—
`Error_description`	—
`CorrelationID`	—
`Error`	—
`ErrorDescription`	—

Event ID 1083 — Protected key error: %1 Error description: %2 CorrelationID: %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Protected key error: %1
Error description: %2
CorrelationID: %3

Fields

Name	Description
`Protected_key_error`	—
`Error_description`	—
`CorrelationID`	—
`Error`	—
`ErrorDescription`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-1083-1061-sam-error-12294

Event ID 1084 — Http transport error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Http transport error. Status: %1 Correlation ID: %2

Fields

Name	Description
`Http_transport_error_Status`	Http transport error. Status.
`Correlation_ID`	—
`Result`	—
`Target`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-event-id-2108-1084

Event ID 1085 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1086 — Get user realm failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Get user realm failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Get_user_realm_failure_Status`	Get user realm failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1087 — Get credential keys failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Get credential keys failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Get_credential_keys_failure_Status`	Get credential keys failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1088 — WSTrust response error: %1 Error description: %2.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

WSTrust response error: %1
Error description: %2

Fields

Name	Description
`WSTrust_response_error`	—
`Error_description`	—
`Error`	—
`ErrorDescription`	—

Event ID 1089 — Device is not cloud domain joined.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Device is not cloud domain joined: %1

Fields

Name	Description
`Status`	—

Event ID 1090 — NGC nonce response error: %1 Error description: %2 CorrelationID: %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

NGC nonce response error: %1
Error description: %2
CorrelationID: %3

Fields

Name	Description
`NGC_nonce_response_error`	—
`Error_description`	—
`CorrelationID`	—
`Error`	—
`ErrorDescription`	—

Event ID 1091 — NGC auth ticket is not defined.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

NGC auth ticket is not defined. Error: %1

Fields

Name	Description
`Result`	—

Event ID 1092 — OAuth request retry.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

OAuth request retry. Correlation ID: %1 Retry: %2

Fields

Name	Description
`OAuth_request_retry_Correlation_ID`	OAuth request retry. Correlation ID.
`Retry`	—
`CorrelationID`	—
`RetryNumber`	—

Event ID 1093 — NGC call %1 returned error: %2.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

NGC call %1 returned error: %2

Fields

Name	Description
`API`	—
`Result`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-event-id-1093

Event ID 1094 — Refresh token failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Refresh token failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Refresh_token_failure_Status`	Refresh token failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1095 — Refresh token user SIDs don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Refresh token user SIDs don't match. Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1096 — Refresh token is expired.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Refresh token is expired. Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1097 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: 3
Samples: 1

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Example Event

system:
  provider: Microsoft-Windows-AAD
  guid: 4DE9BC9C-B27A-43C9-8994-0915F1A5E24F
  event_source_name: ''
  event_id: 1097
  version: 0
  level: 3
  task: 103
  opcode: 0
  keywords: 4611686018427387952
  time_created: '2023-11-05T22:29:32.897824+00:00'
  event_record_id: 8
  correlation:
    ActivityID: 59A0D65F-1037-0002-97FA-A0593710DA01
  execution:
    process_id: 7788
    thread_id: 7496
  channel: Microsoft-Windows-AAD/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  Error: 2325807322
  ErrorMessage: Upgrade default pawn task complete.
  AdditionalInformation: 'Logged at UpdateDefaultPawn.cpp, line: 43, method: UpdateDefaultPawn::Apply.'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1098 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1099 — Code: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Code: %1 %2
%3

Fields

Name	Description
`Code`	—
`OperationCode`	—
`OperationMessage`	—
`AdditionalInformation`	—

Event ID 1100 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1101 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1102 — Code: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Code: %1 %2
%3

Fields

Name	Description
`Code`	—
`OperationCode`	—
`OperationMessage`	—
`AdditionalInformation`	—

Event ID 1103 — Can't decrypt OAuth response.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Can't decrypt OAuth response. Error: %1

Fields

Name	Description
`Cant_decrypt_OAuth_response_Error`	Can't decrypt OAuth response. Error.
`Result`	—

Event ID 1104 — AAD Cloud AP plugin call %1 returned error: %2.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: 2
Samples: 1

Message

AAD Cloud AP plugin call %1 returned error: %2

Fields

Name	Description
`API`	—
`Result`	1 returned error.

Example Event

system:
  provider: Microsoft-Windows-AAD
  guid: 4DE9BC9C-B27A-43C9-8994-0915F1A5E24F
  event_source_name: ''
  event_id: 1104
  version: 0
  level: 2
  task: 101
  opcode: 0
  keywords: 4611686018427387922
  time_created: '2022-04-07T16:53:02.149442+00:00'
  event_record_id: 10
  correlation:
    ActivityID: E0AAB88C-4A9F-0000-71B9-AAE09F4AD801
  execution:
    process_id: 664
    thread_id: 668
  channel: Microsoft-Windows-AAD/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  API: Plugin initialize
  Result: 3221521494
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1105 — Device registration API call %1 returned error: %2.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Device registration API call %1 returned error: %2

Fields

Name	Description
`API`	—
`Result`	—

Event ID 1106 — Number of security groups received %1.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Number of security groups received %1. CorrelationID: %2

Fields

Name	Description
`value`	—
`CorrelationID`	—

Event ID 1107 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1108 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1109 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1110 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1111 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1112 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1113 — Code: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Code: %1 %2
%3

Fields

Name	Description
`Code`	—
`OperationCode`	—
`OperationMessage`	—
`AdditionalInformation`	—

Event ID 1114 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1115 — Error: %1 %2 %3.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Error: %1 %2
%3

Fields

Name	Description
`Error`	—
`ErrorMessage`	—
`AdditionalInformation`	—

Event ID 1116 — Get Enterprise STS OAuth Info failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Get Enterprise STS OAuth Info failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`CorrelationID`	—

References

Event ID 1117 — Enterprise STS Refresh token failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Enterprise STS Refresh token failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`CorrelationID`	—

References

Event ID 1118 — Enterprise STS Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Enterprise STS Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Enterprise_STS_Logon_failure_Status`	Enterprise STS Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1119 — Enterprise STS OAuth Info response.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Enterprise STS OAuth Info response: %1.
Request status: %2

Fields

Name	Description
`Enterprise_STS_OAuth_Info_response`	—
`Request_status`	—
`Response`	—
`Status`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1120 — Enterprise STS Refresh token is expired.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Enterprise STS Refresh token is expired. Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1121 — Enterprise STS RefreshToken Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Enterprise STS RefreshToken Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1122 — Refresh token subject don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Refresh token subject don't match. Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1123 — AadCloudAPPlugin smart card logon for non-federated user.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin smart card logon for non-federated user.

Event ID 1124 — Device is DRS joined but Enterprise STS is disabled.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Device is DRS joined but Enterprise STS is disabled: %1

Fields

Name	Description
`Status`	—

Event ID 1125 — AadCloudAPPlugin loaded as surrogate, no key recovery

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin loaded as surrogate, no key recovery

Event ID 1126 — AadCloudAPPlugin device is Enterprise joined

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin device is Enterprise joined

Event ID 1127 — AadCloudAPPlugin device P2P certificate update thread started

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin device P2P certificate update thread started

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1128 — AadCloudAPPlugin device P2P certificate update thread stopped

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin device P2P certificate update thread stopped

Event ID 1129 — AadCloudAPPlugin Uninitialize Stop

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Uninitialize Stop

Fields

Name	Description
`Status`	—

Event ID 1130 — AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_DeviceP2PCertificateUpdate_Correlation_ID`	—
`value`	—

Event ID 1131 — Update P2P device certificate failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Update P2P device certificate failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`CorrelationID`	—

Event ID 1132 — AadCloudAPPlugin GetCertificateFromCred Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetCertificateFromCred Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_GetCertificateFromCred_Correlation_ID`	—
`value`	—

Event ID 1133 — Update P2P user certificate failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Update P2P user certificate failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`CorrelationID`	—

Event ID 1134 — AAD Cloud AP plugin call %1 returned error: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AAD Cloud AP plugin call %1 returned error: %2

Fields

Name	Description
`API`	—
`Result`	—

Event ID 1135 — AadCloudAPPlugin RenewCertificate Correlation ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RenewCertificate Correlation ID: %1

Fields

Name	Description
`AadCloudAPPlugin_RenewCertificate_Correlation_ID`	—
`value`	—

Event ID 1136 — AadCloudAPPlugin AcceptPeerCertificate Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin AcceptPeerCertificate Start

Event ID 1137 — AadCloudAPPlugin AcceptPeerCertificate Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin AcceptPeerCertificate Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1138 — AadCloudAPPlugin RenewCertificate Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RenewCertificate Start

Event ID 1139 — AadCloudAPPlugin RenewCertificate Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RenewCertificate Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1140 — AadCloudAPPlugin GetCertificateFromCred Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetCertificateFromCred Start

Event ID 1141 — AadCloudAPPlugin GetCertificateFromCred Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin GetCertificateFromCred Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1142 — Get token user names don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Get token user names don't match. Correlation ID: %1

Fields

Name	Description
`value`	—

Event ID 1143 — Generic Call Package call type.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Generic Call Package call type: %1. Correlation ID: %2

Fields

Name	Description
`Generic_Call_Packate_call_type`	—
`Correlation_ID`	—
`value`	—
`CorrelationID`	—

Event ID 1144 — Realm discovery for: %2 authority: %3 fallback domain hint: %4 useUpn: %1.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Realm discovery for: %2 authority: %3 fallback domain hint: %4 useUpn: %1

Fields

Name	Description
`value`	—
`Method`	—
`EndpointUri`	—
`CorrelationID`	—

Event ID 1145 — AAD Cloud AP plugin token needs refresh reason.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AAD Cloud AP plugin token needs refresh reason: %1

Fields

Name	Description
`value`	—

Event ID 1146 — Token is not refreshed.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token is not refreshed. token time: %1 update time: %2

Fields

Name	Description
`NoOfTargets`	—
`RequestType`	—

Event ID 1147 — AadCloudAPPlugin AssembleOpaqueData Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin AssembleOpaqueData Start

Event ID 1148 — AadCloudAPPlugin AssembleOpaqueData Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin AssembleOpaqueData Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1149 — AadCloudAPPlugin DisassembleOpaqueData Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin DisassembleOpaqueData Start

References

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshoot-remote-desktop-disconnected-errors

Event ID 1150 — AadCloudAPPlugin DisassembleOpaqueData Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin DisassembleOpaqueData Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1151 — AadCloudAPPlugin P2P device certificate update error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin P2P device certificate update error: %1

Fields

Name	Description
`Status`	—

Event ID 1152 — AadCloudAPPlugin device certificate key error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin device certificate key error: %1

Fields

Name	Description
`Result`	—

Event ID 1153 — AadCloudAPPlugin device certificate not available for logon.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin device certificate not available for logon: %1

Fields

Name	Description
`value`	—

Event ID 1154 — Password expiration claims.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Password expiration claims. Seconds: %1 URI: %2

Fields

Name	Description
`Password_expiration_claims_Seconds`	Password expiration claims. Seconds.
`URI`	—
`seconds`	—

Event ID 1155 — Logon with session key failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon with session key failure. Retrying with device auth. Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`CorrelationID`	—

Event ID 1156 — Password expiration fields.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Password expiration fields. Status: %1 Date: %2 URI: %3

Fields

Name	Description
`Password_expiration_fields_Status`	Password expiration fields. Status.
`Date`	—
`URI`	—
`Status`	—
`ExpiryTime`	—
`PasswordChangeURI`	—

Event ID 1157 — AadCloudAPPlugin PostLogonProcessing Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin PostLogonProcessing Start

Event ID 1158 — AadCloudAPPlugin PostLogonProcessing Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin PostLogonProcessing Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1159 — AadCloudAPPlugin S2U logon failed.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin S4U logon failed. Status: %1

Fields

Name	Description
`AadCloudAPPlugin_S2U_logon_failed_Status`	AadCloudAPPlugin S2U logon failed. Status.
`Status`	—

Event ID 1160 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1161 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1162 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1163 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1164 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1165 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Logon failure. Status: %1 Correlation ID: %2

Fields

Name	Description
`Logon_failure_Status`	Logon failure. Status.
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1200 — BrowserCore operation started

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

BrowserCore operation started

Event ID 1201 — BrowserCore operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

BrowserCore operation completed successfully.
Method: %1
CorrelationID: %2

Fields

Name	Description
`Method`	—
`CorrelationID`	—

Event ID 1202 — BrowserCore operation completed with a failure.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

BrowserCore operation completed with a failure.
Error: %1
Error Message: %2
Method: %3
CorrelationID: %4

Fields

Name	Description
`Error`	—
`Error_Message`	—
`Result`	—
`ErrorMessage`	—
`Method`	—
`CorrelationID`	—

Event ID 1203 — BrowserCore inner operation %2 completed with error: %1.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

BrowserCore inner operation %2 completed with error: %1

Fields

Name	Description
`Result`	—
`FunctionName`	—

Event ID 1204 — AadCloudAPPlugin LookupSIDFromIdentityName Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupSIDFromIdentityName Start

Event ID 1205 — AadCloudAPPlugin LookupSIDFromIdentityName Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupSIDFromIdentityName Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1206 — AadCloudAPPlugin LookupIdentityFromSIDName Start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupIdentityFromSIDName Start

Event ID 1207 — AadCloudAPPlugin LookupIdentityFromSIDName Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupIdentityFromSIDName Stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1208 — AadCloudAPPlugin LookupSIDFromIdentity Identity: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupSIDFromIdentity Identity: %1 Correlation ID: %2

Fields

Name	Description
`AadCloudAPPlugin_LookupSIDFromIdentity_Identity`	—
`Correlation_ID`	—
`value1`	—
`value2`	—

Event ID 1209 — AadCloudAPPlugin LookupIdentityFromSID SID: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin LookupIdentityFromSID SID: %1 Correlation ID: %2

Fields

Name	Description
`AadCloudAPPlugin_LookupIdentityFromSID_SID`	—
`Correlation_ID`	—
`value1`	—
`value2`	—

Event ID 1210 — AadCloudAPPlugin password expired, password change URI.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AadCloudAPPlugin password expired, password change URI: %1

Fields

Name	Description
`value`	—

Event ID 1211 — Writing RunRecovery registry value failed.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Writing RunRecovery registry value failed.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1212 — Enterprise logon.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Enterprise logon. Password is expired.
Status: %1 Correlation ID: %2

Fields

Name	Description
`Status`	—
`Correlation_ID`	—
`CorrelationID`	—

Event ID 1213 — WamExtension process token operation started

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension process token operation started.

Event ID 1214 — WamExtension process token operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension process token operation completed successfully

Event ID 1215 — WamExtension process token operation completed with error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: 2
Samples: 1

Message

WamExtension process token operation completed with error: %1

Fields

Name	Description
`Data`	WamExtension process token operation completed with error.

Example Event

system:
  provider: Microsoft-Windows-AAD
  guid: 4DE9BC9C-B27A-43C9-8994-0915F1A5E24F
  event_source_name: ''
  event_id: 1215
  version: 0
  level: 2
  task: 107
  opcode: 2
  keywords: 4611686018427387922
  time_created: '2022-04-07T16:44:49.386586+00:00'
  event_record_id: 2
  correlation: {}
  execution:
    process_id: 2080
    thread_id: 2748
  channel: Microsoft-Windows-AAD/Operational
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-18
event_data:
  Data:
    Name: Result
    Value: "\x04�\x04�"
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1216 — WamExtension device authentication call status: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension device authentication call status: %1 Correlation ID: %2

Fields

Name	Description
`Result`	—
`Target`	—

Event ID 1217 — Get device token.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Get device token. Resource: %1 ClientID: %2 Scope: %3

Fields

Name	Description
`Get_device_token_Resource`	Get device token. Resource.
`ClientID`	—
`Scope`	—
`value1`	—
`value2`	—
`value3`	—

Event ID 1218 — StartFidoAuthenticationSession start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

StartFidoAuthenticationSession start

Event ID 1219 — StartFidoAuthenticationSession stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

StartFidoAuthenticationSession stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1220 — CloseFidoAuthenticationSession start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

CloseFidoAuthenticationSession start

Event ID 1221 — CloseFidoAuthenticationSession stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

CloseFidoAuthenticationSession stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1222 — GetClientData start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

GetClientData start

Event ID 1223 — GetClientData stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

GetClientData stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1224 — SignClientDataFido start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

SignClientDataFido start

Event ID 1225 — SignClientDataFido stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

SignClientDataFido stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1226 — ChangePin start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

ChangePin start

Event ID 1227 — ChangePin stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

ChangePin stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1228 — GetSerializedAuthBuffer start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

GetSerializedAuthBuffer start

Event ID 1229 — GetSerializedAuthBuffer stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

GetSerializedAuthBuffer stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1230 — AuthHelper call %1 returned error: %2.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AuthHelper call %1 returned error: %2

Fields

Name	Description
`API`	—
`Result`	—

Event ID 1231 — AadCloudAPPlugin Resource infomation.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin Resource infomation: %1.
Request status: %2

Fields

Name	Description
`AadCloudAPPlugin_Resource_infomation`	—
`Request_status`	—
`Response`	—
`Status`	—

Event ID 1232 — AadCloudAPPlugin RBAC authorization code response.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin RBAC authorization code response: %1.
Request status: %2

Fields

Name	Description
`Response`	—
`Status`	—

Event ID 1233 — AadCloudAPPlugin User access control role.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin User access control role: %1

Fields

Name	Description
`value`	—

Event ID 1234 — AadCloudAPPlugin using resource id from the Idtoken.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AadCloudAPPlugin using resource id from the Idtoken: %1

Fields

Name	Description
`value`	—

Event ID 1235 — RBAC Status: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

RBAC Status: %1 Correlation ID: %2

Fields

Name	Description
`RBAC_Status`	—
`Correlation_ID`	—
`Status`	—
`CorrelationID`	—

Event ID 1236 — Failed to create the resource id

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Failed to create the resource id

Event ID 1237 — Device is configured for RBAC authorization

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Device is configured for RBAC authorization

Event ID 1238 — Not sending the client certificate as it is optional on the server

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Not sending the client certificate as it is optional on the server

Event ID 1239 — Doing RBAC logon

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Doing RBAC logon of the device type: %1

Fields

Name	Description
`value`	—

Event ID 1240 — Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate

Event ID 1241 — On-prem tgt error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

On-prem tgt error: %1

Fields

Name	Description
`Onprem_tgt_error`	On-prem tgt error.
`value`	—

Event ID 1242 — Added user to admins security group

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Added user to admins security group

Event ID 1243 — Removed user from admins security group

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Removed user from admins security group

Event ID 1244 — Security groups were not loaded.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Security groups were not loaded. Error: %1

Fields

Name	Description
`Status`	—

Event ID 1245 — Security groups were not updated.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Security groups were not updated. Error: %1

Fields

Name	Description
`Status`	—

Event ID 1246 — User sid: %1 Group sids: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

User sid: %1
Group sids:
%2

Fields

Name	Description
`User_sid`	—
`Group_sids`	—
`value1`	—
`value2`	—

Event ID 1247 — RunRecovery registry value successfully written.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

RunRecovery registry value (%1) successfully written.
Context: %2
Reason: %3

Fields

Name	Description
`Context`	—
`Reason`	—
`value`	—
`Result`	—

Event ID 1248 — AuthHelper auth buff local nonce

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

AuthHelper auth buff local nonce

Event ID 1249 — Cloud tgt error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Cloud tgt error: %1

Fields

Name	Description
`Cloud_tgt_error`	—
`value`	—

Event ID 1250 — DoGetToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: %3 Correlation ID: %4 Endpoint Uri: %5 HTTP Status: %6 HTTP Method: %7 E...

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

DoGetToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields

Name	Description
`Result`	[DoGetToken Diagnostic Event] Result.
`User_Identity`	[DoGetToken Diagnostic Event] User Identity.
`Credential_Type`	[DoGetToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoGetToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoGetToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoGetToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoGetToken Diagnostic Event] HTTP Method.
`ErrorCode`	[DoGetToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoGetToken Diagnostic Event] Error Description.
`UserIdentity`	—
`CredentialType`	—
`CorrelationID`	—
`EndpointUri`	—
`Method`	—
`HTTPTransportError`	—
`HTTPStatus`	—
`ErrorDescription`	—

Event ID 1251 — DoGetEnterpriseToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: %3 Correlation ID: %4 Endpoint Uri: %5 HTTP Status: %6 HTTP Me...

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

DoGetEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields

Name	Description
`Result`	[DoGetEnterpriseToken Diagnostic Event] Result.
`User_Identity`	[DoGetEnterpriseToken Diagnostic Event] User Identity.
`Credential_Type`	[DoGetEnterpriseToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoGetEnterpriseToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoGetEnterpriseToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoGetEnterpriseToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoGetEnterpriseToken Diagnostic Event] HTTP Method.
`ErrorCode`	[DoGetEnterpriseToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoGetEnterpriseToken Diagnostic Event] Error Description.
`UserIdentity`	—
`CredentialType`	—
`CorrelationID`	—
`EndpointUri`	—
`Method`	—
`HTTPTransportError`	—
`HTTPStatus`	—
`ErrorDescription`	—

Event ID 1252 — DoRefreshToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: %3 Correlation ID: %4 Endpoint Uri: %5 HTTP Status: %6 HTTP Method: ...

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

DoRefreshToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields

Name	Description
`Result`	[DoRefreshToken Diagnostic Event] Result.
`User_Identity`	[DoRefreshToken Diagnostic Event] User Identity.
`Credential_Type`	[DoRefreshToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoRefreshToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoRefreshToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoRefreshToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoRefreshToken Diagnostic Event] HTTP Method.
`ErrorCode`	[DoRefreshToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoRefreshToken Diagnostic Event] Error Description.
`UserIdentity`	—
`CredentialType`	—
`NewToken`	—
`CorrelationID`	—
`EndpointUri`	—
`Method`	—
`HTTPTransportError`	—
`HTTPStatus`	—
`ErrorDescription`	—

Event ID 1253 — DoRefreshEnterpriseToken Diagnostic Event: Result: %1 User Identity: %2 Credential Type: %3 Correlation ID: %4 Endpoint Uri: %5 HTTP Status: %6 HTT...

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

DoRefreshEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields

Name	Description
`Result`	[DoRefreshEnterpriseToken Diagnostic Event] Result.
`User_Identity`	[DoRefreshEnterpriseToken Diagnostic Event] User Identity.
`Credential_Type`	[DoRefreshEnterpriseToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoRefreshEnterpriseToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoRefreshEnterpriseToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoRefreshEnterpriseToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoRefreshEnterpriseToken Diagnostic Event] HTTP Method.
`ErrorCode`	[DoRefreshEnterpriseToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoRefreshEnterpriseToken Diagnostic Event] Error Description.
`UserIdentity`	—
`CredentialType`	—
`NewToken`	—
`CorrelationID`	—
`EndpointUri`	—
`Method`	—
`HTTPTransportError`	—
`HTTPStatus`	—
`ErrorDescription`	—

Event ID 1254 — Response content type.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Response content type: %1

Fields

Name	Description
`Response_content_type`	—
`value`	—

Event ID 1255 — AD TGT: %1 Cloud TGT: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

AD TGT: %1 Cloud TGT: %2

Fields

Name	Description
`AD_TGT`	—
`Cloud_TGT`	—
`NoOfTargets`	—
`RequestType`	—

Event ID 1256 — P2P certificate update error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

P2P certificate update error. Status: %1 Correlation ID: %2

Fields

Name	Description
`P2P_certificate_update_error_Status`	P2P certificate update error. Status.
`Correlation_ID`	—
`Result`	—
`Target`	—

Event ID 1257 — Credbuffer correlation ID: %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Credbuffer correlation ID: %1 Correlation ID: %2

Fields

Name	Description
`Credbuffer_correlation_ID`	—
`Correlation_ID`	—
`value1`	—
`value2`	—

Event ID 1258 — CA cert hash (keyID): %1 Correlation ID: %2.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

CA cert hash (keyID): %1 Correlation ID: %2

Fields

Name	Description
`CA_cert_hash_keyID`	CA cert hash (keyID).
`Correlation_ID`	—
`value1`	—
`value2`	—

Event ID 1259 — CA certificate update error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

CA certificate update error. Status: %1 Correlation ID: %2

Fields

Name	Description
`CA_certificate_update_error_Status`	CA certificate update error. Status.
`Correlation_ID`	—
`Result`	—
`Target`	—

Event ID 1260 — RetryGetClientData start

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

RetryGetClientData start

Event ID 1261 — RetryGetClientData stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

RetryGetClientData stop.
Status: %1

Fields

Name	Description
`Status`	—

Event ID 1262 — Binding key tag check failed.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

Binding key tag check failed: %1

Fields

Name	Description
`Binding_key_tag_check_failed`	—
`Status`	—

Event ID 1263 — BrowserCore inner operation %2 with account pairwiseID %1 not found error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

BrowserCore inner operation %2 with account pairwiseID %1 not found error

Fields

Name	Description
`PairwiseID`	—
`FunctionName`	—

Event ID 1264 — Token binding key created.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding key created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—

Event ID 1265 — WamExtension preprocess token operation started.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension preprocess token operation started.

Event ID 1266 — WamExtension preprocess token operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension preprocess token operation completed successfully

Event ID 1267 — WamExtension preprocess token operation completed with error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

WamExtension preprocess token operation completed with error: %1

Fields

Name	Description
`Result`	—

Event ID 1268 — WamExtension postprocess token operation started.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension postprocess token operation started.
Stage: %1

Fields

Name	Description
`Stage`	—

Event ID 1269 — WamExtension postprocess token operation completed successfully.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

WamExtension postprocess token operation completed successfully.
Stage: %1

Fields

Name	Description
`Stage`	—

Event ID 1270 — WamExtension postprocess token operation completed with error.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

WamExtension postprocess token operation completed with error: %2.
Stage: %1

Fields

Name	Description
`Stage`	—
`Result`	—

Event ID 1271 — Token binding claim(s) included in the request.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claim(s) included in the request. Correlation ID: %1

Fields

Name	Description
`CorrelationID`	—

Event ID 1272 — Token binding key is not healthy and needs to be re-created.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding key is not healthy and needs to be re-created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4
Test result: %5

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—
`KeyTestResult`	—

Event ID 1273 — Token binding claims need to be re-generated due to changes in attestation key(s).

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims need to be re-generated due to changes in attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—

Event ID 1274 — Token binding claims generated.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims generated.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—

Event ID 1275 — Token binding claims generated for UI request.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims generated for UI request.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—

Event ID 1276 — Token binding claims count.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims count: %1

Fields

Name	Description
`ClaimsCount`	—

Event ID 1277 — KeyGuard availability detection failed.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

KeyGuard availability detection failed. Error: %1

Fields

Name	Description
`Result`	—

Event ID 1278 — KeyGuard with attestation support is not detected.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

KeyGuard with attestation support is not detected.

Event ID 1279 — Token binding claims of type %1 could not be generated because AIK does not exist.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims of type %1 could not be generated because AIK does not exist.
Join Type: %2
Tenant ID: %3

Fields

Name	Description
`KeyType`	—
`JoinType`	—
`TenantId`	—

Event ID 1280 — PRT session key needs to be rolled.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

PRT session key needs to be rolled.
Reason: %1

Fields

Name	Description
`Reason`	—
`RollReason`	—

Event ID 1281 — Token binding key deleted.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding key deleted.
Key: %1

Fields

Name	Description
`Key`	—

Event ID 1282 — SHR property in request is not allowed.

Provider: Microsoft-Windows-AAD
Channel: Operational

Message

SHR property in request is not allowed. Property: %1

Fields

Name	Description
`PropertyName`	—

Event ID 1283 — Invalid registry value was ignored.

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Invalid registry value was ignored.
Location: %1
Value name: %2
Value: %3

Fields

Name	Description
`RegistryLocation`	—
`RegistryValueName`	—
`Value`	—

Event ID 1284 — Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).

Provider: Microsoft-Windows-AAD
Channel: Analytic

Message

Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields

Name	Description
`KeyType`	—
`ClientId`	—
`Resource`	—
`Scope`	—