Microsoft-Windows-AAD

204 events across 2 channels

Event ID	Title	Channel
1001	AadCloudAPPlugin Initialize Start	Analytic
1002	AadCloudAPPlugin Initialize Stop.	Analytic
1003	AadCloudAPPlugin Uninitialize Start	Analytic
1004	AadCloudAPPlugin ValidateUserInfo Start	Analytic
1005	AadCloudAPPlugin ValidateUserInfo Stop.	Analytic
1006	AadCloudAPPlugin GetToken Start	Analytic
1007	AadCloudAPPlugin GetToken Stop.	Analytic
1008	AadCloudAPPlugin GetKeys Start	Analytic
1009	AadCloudAPPlugin GetKeys Stop.	Analytic
1010	AadCloudAPPlugin GetUnlockKey Start	Analytic
1011	AadCloudAPPlugin GetUnlockKey Stop.	Analytic
1012	AadCloudAPPlugin PersistSSOTokens Start	Analytic
1013	AadCloudAPPlugin PersistSSOTokens Stop.	Analytic
1015	AadCloudAPPlugin Realm discovery response: …	Analytic
1016	AadCloudAPPlugin device is cloud domain joined	Analytic
1017	AadCloudAPPlugin device is domain joined	Analytic
1018	AadCloudAPPlugin GetToken Correlation ID: …	Analytic
1019	AadCloudAPPlugin GetKeys Correlation ID: …	Analytic
1020	AadCloudAPPlugin loaded as surrogate	Analytic
1021	AadCloudAPPlugin MEX request status: AadCloudAPPlugin_MEX_request_status.	Analytic
1022	Endpoint Uri: Endpoint_Uri.	Analytic
1023	NGC UserID Key: NGC_UserID_Key.	Analytic
1024	Http request status: Http_request_status.	Operational
1025	Http request status: Http_request_status.	Operational
1026	Credential type: Credential_type Correlation ID: Correlation_ID.	Analytic
1027	AadCloudAPPlugin managed logon flow for federated NGC user.	Analytic
1028	AadCloudAPPlugin RefreshToken Start	Analytic
1029	AadCloudAPPlugin RefreshToken Stop.	Analytic
1030	AadCloudAPPlugin RefreshToken Correlation ID: …	Analytic
1031	AadCloudAPPlugin encrypted OAuth response received	Analytic
1032	Number of groups received: value.	Analytic
1033	Validation needed: Validation_needed.	Analytic
1034	AadCloudAPPlugin GenericCallPkg Start	Analytic
1035	AadCloudAPPlugin GenericCallPkg Stop.	Analytic
1081	OAuth response error: OAuth_response_error.	Operational
1082	Key error: Key_error.	Operational
1083	Protected key error: Protected_key_error.	Operational
1084	Http transport error.	Operational
1085	Logon failure.	Operational
1086	Get user realm failure.	Operational
1087	Get credential keys failure.	Operational
1088	WSTrust response error: WSTrust_response_error.	Operational
1089	Device is not cloud domain joined: Status.	Operational
1090	NGC nonce response error: NGC_nonce_response_error.	Operational
1091	NGC auth ticket is not defined.	Operational
1092	OAuth request retry.	Operational
1093	NGC call API returned error: Result.	Operational
1094	Refresh token failure.	Operational
1095	Refresh token user SIDs don't match.	Operational
1096	Refresh token is expired.	Operational
1097	Error: Error ErrorMessage AdditionalInformation.	Operational
1098	Error: Error ErrorMessage AdditionalInformation.	Operational
1099	Code: Code OperationCode OperationMessage.	Analytic
1100	Error: Error ErrorMessage AdditionalInformation.	Operational
1101	Error: Error ErrorMessage AdditionalInformation.	Operational
1102	Code: Code OperationCode OperationMessage.	Analytic
1103	Can't decrypt OAuth response.	Operational
1104	AAD Cloud AP plugin call API returned error: Result.	Operational
1105	Device registration API call API returned error: Result.	Operational
1106	Number of security groups received value.	Operational
1107	Error: Error ErrorMessage AdditionalInformation.	Analytic
1108	Error: Error ErrorMessage AdditionalInformation.	Analytic
1109	Error: Error ErrorMessage AdditionalInformation.	Analytic
1110	Error: Error ErrorMessage AdditionalInformation.	Analytic
1111	Error: Error ErrorMessage AdditionalInformation.	Operational
1112	Error: Error ErrorMessage AdditionalInformation.	Operational
1113	Code: Code OperationCode OperationMessage.	Analytic
1114	Error: Error ErrorMessage AdditionalInformation.	Analytic
1115	Error: Error ErrorMessage AdditionalInformation.	Analytic
1116	Get Enterprise STS OAuth Info failure.	Operational
1117	Enterprise STS Refresh token failure.	Operational
1118	Enterprise STS Logon failure.	Operational
1119	Enterprise STS OAuth Info response: Enterprise_STS_OAuth_Info_response.	Analytic
1120	Enterprise STS Refresh token is expired.	Operational
1121	Enterprise STS RefreshToken Correlation ID: value.	Analytic
1122	Refresh token subject don't match.	Operational
1123	AadCloudAPPlugin smart card logon for non-federated user.	Operational
1124	Device is DRS joined but Enterprise STS is disabled: Status.	Operational
1125	AadCloudAPPlugin loaded as surrogate, no key recovery	Analytic
1126	AadCloudAPPlugin device is Enterprise joined	Analytic
1127	AadCloudAPPlugin device P2P certificate update thread started	Analytic
1128	AadCloudAPPlugin device P2P certificate update thread stopped	Analytic
1129	AadCloudAPPlugin Uninitialize Stop	Analytic
1130	AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: …	Analytic
1131	Update P2P device certificate failure.	Operational
1132	AadCloudAPPlugin GetCertificateFromCred Correlation ID: …	Analytic
1133	Update P2P user certificate failure.	Operational
1134	AAD Cloud AP plugin call API returned error: Result.	Analytic
1135	AadCloudAPPlugin RenewCertificate Correlation ID: …	Analytic
1136	AadCloudAPPlugin AcceptPeerCertificate Start	Analytic
1137	AadCloudAPPlugin AcceptPeerCertificate Stop.	Analytic
1138	AadCloudAPPlugin RenewCertificate Start	Analytic
1139	AadCloudAPPlugin RenewCertificate Stop.	Analytic
1140	AadCloudAPPlugin GetCertificateFromCred Start	Analytic
1141	AadCloudAPPlugin GetCertificateFromCred Stop.	Analytic
1142	Get token user names don't match.	Operational
1143	Generic Call Package call type: Generic_Call_Packate_call_type.	Analytic
1144	Realm discovery for: Method authority: EndpointUri fallback domain hint: …	Analytic
1145	AAD Cloud AP plugin token needs refresh reason: value.	Analytic
1146	Token is not refreshed.	Analytic
1147	AadCloudAPPlugin AssembleOpaqueData Start	Analytic
1148	AadCloudAPPlugin AssembleOpaqueData Stop.	Analytic
1149	AadCloudAPPlugin DisassembleOpaqueData Start	Analytic
1150	AadCloudAPPlugin DisassembleOpaqueData Stop.	Analytic
1151	AadCloudAPPlugin P2P device certificate update error: Status.	Operational
1152	AadCloudAPPlugin device certificate key error: Result.	Operational
1153	AadCloudAPPlugin device certificate not available for logon: value.	Operational
1154	Password expiration claims.	Analytic
1155	Logon with session key failure.	Operational
1156	Password expiration fields.	Analytic
1157	AadCloudAPPlugin PostLogonProcessing Start	Analytic
1158	AadCloudAPPlugin PostLogonProcessing Stop.	Analytic
1159	AadCloudAPPlugin S4U logon failed.	Operational
1160	Logon failure.	Operational
1161	Logon failure.	Operational
1162	Logon failure.	Operational
1163	Logon failure.	Operational
1164	Logon failure.	Operational
1165	Logon failure.	Operational
1200	BrowserCore operation started	Analytic
1201	BrowserCore operation completed successfully	Analytic
1202	BrowserCore operation completed with a failure.	Operational
1203	BrowserCore inner operation FunctionName completed with error: Result.	Operational
1204	AadCloudAPPlugin LookupSIDFromIdentityName Start	Analytic
1205	AadCloudAPPlugin LookupSIDFromIdentityName Stop.	Analytic
1206	AadCloudAPPlugin LookupIdentityFromSIDName Start	Analytic
1207	AadCloudAPPlugin LookupIdentityFromSIDName Stop.	Analytic
1208	AadCloudAPPlugin LookupSIDFromIdentity Identity: …	Analytic
1209	AadCloudAPPlugin LookupIdentityFromSID SID: …	Analytic
1210	AadCloudAPPlugin password expired, password change URI: value.	Operational
1211	Writing RunRecovery registry value failed.	Operational
1212	Enterprise logon.	Operational
1213	WamExtension process token operation started	Analytic
1214	WamExtension process token operation completed successfully	Analytic
1215	WamExtension process token operation completed with error: Data.	Operational
1216	WamExtension device authentication call status: Result Correlation ID: Target.	Analytic
1217	Get device token.	Analytic
1218	StartFidoAuthenticationSession start	Analytic
1219	StartFidoAuthenticationSession stop.	Analytic
1220	CloseFidoAuthenticationSession start	Analytic
1221	CloseFidoAuthenticationSession stop.	Analytic
1222	GetClientData start	Analytic
1223	GetClientData stop.	Analytic
1224	SignClientDataFido start	Analytic
1225	SignClientDataFido stop.	Analytic
1226	ChangePin start	Analytic
1227	ChangePin stop.	Analytic
1228	GetSerializedAuthBuffer start	Analytic
1229	GetSerializedAuthBuffer stop.	Analytic
1230	AuthHelper call API returned error: Result.	Operational
1231	AadCloudAPPlugin Resource infomation: AadCloudAPPlugin_Resource_infomation.	Analytic
1232	AadCloudAPPlugin RBAC authorization code response: Response.	Analytic
1233	AadCloudAPPlugin User access control role: value.	Analytic
1234	AadCloudAPPlugin using resource id from the Idtoken: value.	Analytic
1235	RBAC Status: RBAC_Status Correlation ID: Correlation_ID.	Analytic
1236	Failed to create the resource id	Analytic
1237	Device is configured for RBAC authorization	Operational
1238	Not sending the client certificate as it is optional on the server	Analytic
1239	Doing RBAC logon of the device type: value.	Analytic
1240	Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate	Analytic
1241	On-prem tgt error: Onprem_tgt_error.	Operational
1242	Added user to admins security group	Analytic
1243	Removed user from admins security group	Analytic
1244	Security groups were not loaded.	Operational
1245	Security groups were not updated.	Operational
1246	User sid: User_sid Group sids: Group_sids.	Analytic
1247	RunRecovery registry value (Context) successfully written.	Operational
1248	AuthHelper auth buff local nonce	Operational
1249	Cloud tgt error: Cloud_tgt_error.	Operational
1250	DoGetToken Diagnostic Event.	Operational
1251	DoGetEnterpriseToken Diagnostic Event.	Operational
1252	DoRefreshToken Diagnostic Event.	Operational
1253	DoRefreshEnterpriseToken Diagnostic Event.	Operational
1254	Response content type: Response_content_type.	Analytic
1255	AD TGT: AD_TGT Cloud TGT: Cloud_TGT.	Analytic
1256	P2P certificate update error.	Operational
1257	Credbuffer correlation ID: Credbuffer_correlation_ID Correlation ID: …	Analytic
1258	CA cert hash (keyID): CA_cert_hash_keyID Correlation ID: Correlation_ID.	Analytic
1259	CA certificate update error.	Operational
1260	RetryGetClientData start	Analytic
1261	RetryGetClientData stop.	Analytic
1262	Binding key tag check failed: Binding_key_tag_check_failed.	Operational
1263	BrowserCore inner operation FunctionName with account pairwiseID PairwiseID not …	Operational
1264	Token binding key created.	Analytic
1265	WamExtension preprocess token operation started.	Analytic
1266	WamExtension preprocess token operation completed successfully	Analytic
1267	WamExtension preprocess token operation completed with error: Result.	Operational
1268	WamExtension postprocess token operation started.	Analytic
1269	WamExtension postprocess token operation completed successfully.	Analytic
1270	WamExtension postprocess token operation completed with error: Result.	Operational
1271	Token binding claim(s) included in the request.	Analytic
1272	Token binding key is not healthy and needs to be re-created.	Analytic
1273	Token binding claims need to be re-generated due to changes in attestation …	Analytic
1274	Token binding claims generated.	Analytic
1275	Token binding claims generated for UI request.	Analytic
1276	Token binding claims count: ClaimsCount.	Analytic
1277	KeyGuard availability detection failed.	Operational
1278	KeyGuard with attestation support is not detected.	Operational
1279	Token binding claims of type KeyType could not be generated because AIK does not …	Analytic
1280	PRT session key needs to be rolled.	Operational
1281	Token binding key deleted.	Analytic
1282	SHR property in request is not allowed.	Operational
1283	Invalid registry value was ignored.	Analytic
1284	Token binding claims need to be re-generated as cached claims were generated for …	Analytic

Event ID 1001 — AadCloudAPPlugin Initialize Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin Initialize Start.

Message #

AadCloudAPPlugin Initialize Start

Event ID 1002 — AadCloudAPPlugin Initialize Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin Initialize Stop.

Message #

AadCloudAPPlugin Initialize Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1003 — AadCloudAPPlugin Uninitialize Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin Uninitialize Start.

Message #

AadCloudAPPlugin Uninitialize Start

Event ID 1004 — AadCloudAPPlugin ValidateUserInfo Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin ValidateUserInfo Start.

Message #

AadCloudAPPlugin ValidateUserInfo Start

Event ID 1005 — AadCloudAPPlugin ValidateUserInfo Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin ValidateUserInfo Stop.

Message #

AadCloudAPPlugin ValidateUserInfo Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1006 — AadCloudAPPlugin GetToken Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetToken Start.

Message #

AadCloudAPPlugin GetToken Start

Event ID 1007 — AadCloudAPPlugin GetToken Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin GetToken Stop.

Message #

AadCloudAPPlugin GetToken Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1008 — AadCloudAPPlugin GetKeys Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetKeys Start.

Message #

AadCloudAPPlugin GetKeys Start

Event ID 1009 — AadCloudAPPlugin GetKeys Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin GetKeys Stop.

Message #

AadCloudAPPlugin GetKeys Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1010 — AadCloudAPPlugin GetUnlockKey Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetUnlockKey Start.

Message #

AadCloudAPPlugin GetUnlockKey Start

Event ID 1011 — AadCloudAPPlugin GetUnlockKey Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin GetUnlockKey Stop.

Message #

AadCloudAPPlugin GetUnlockKey Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1012 — AadCloudAPPlugin PersistSSOTokens Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin PersistSSOTokens Start.

Message #

AadCloudAPPlugin PersistSSOTokens Start

Event ID 1013 — AadCloudAPPlugin PersistSSOTokens Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin PersistSSOTokens Stop.

Message #

AadCloudAPPlugin PersistSSOTokens Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1015 — AadCloudAPPlugin Realm discovery response: AadCloudAPPlugin_Realm_discovery_response.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin Realm discovery response: AadCloudAPPlugin_Realm_discovery_response.

Message #

AadCloudAPPlugin Realm discovery response: %1.
Request status: %2

Fields #

Name	Description
`AadCloudAPPlugin_Realm_discovery_response` UnicodeString	—
`Request_status` Int32	—
`Response` UnicodeString	—
`Status` Int32	— NTSTATUS reference

Event ID 1016 — AadCloudAPPlugin device is cloud domain joined

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin device is cloud domain joined.

Message #

AadCloudAPPlugin device is cloud domain joined

Event ID 1017 — AadCloudAPPlugin device is domain joined

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin device is domain joined.

Message #

AadCloudAPPlugin device is domain joined

Event ID 1018 — AadCloudAPPlugin GetToken Correlation ID: AadCloudAPPlugin_GetToken_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetToken Correlation ID: AadCloudAPPlugin_GetToken_Correlation_ID.

Message #

AadCloudAPPlugin GetToken Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_GetToken_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1019 — AadCloudAPPlugin GetKeys Correlation ID: AadCloudAPPlugin_GetKeys_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetKeys Correlation ID: AadCloudAPPlugin_GetKeys_Correlation_ID.

Message #

AadCloudAPPlugin GetKeys Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_GetKeys_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1020 — AadCloudAPPlugin loaded as surrogate

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin loaded as surrogate.

Message #

AadCloudAPPlugin loaded as surrogate

Event ID 1021 — AadCloudAPPlugin MEX request status: AadCloudAPPlugin_MEX_request_status.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin MEX request status: AadCloudAPPlugin_MEX_request_status.

Message #

AadCloudAPPlugin MEX request status: %1

Fields #

Name	Description
`AadCloudAPPlugin_MEX_request_status` Int32	—
`Status` Int32	— NTSTATUS reference

Event ID 1022 — Endpoint Uri: Endpoint_Uri.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

Endpoint Uri: Endpoint_Uri.

Message #

Endpoint Uri: %1

Fields #

Name	Description
`Endpoint_Uri` UnicodeString	—
`value` UnicodeString	—

Event ID 1023 — NGC UserID Key: NGC_UserID_Key.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

NGC UserID Key: NGC_UserID_Key.

Message #

NGC UserID Key: %1

Fields #

Name	Description
`NGC_UserID_Key` UnicodeString	—
`value` UnicodeString	—

Event ID 1024 — Http request status: Http_request_status.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Http request status: Http_request_status.

Message #

Http request status: %1

Fields #

Name	Description
`Http_request_status` Int32	—
`value` Int32	—

Event ID 1025 — Http request status: Http_request_status.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Http request status: Http_request_status. Method: Method Endpoint Uri: Endpoint_Uri Correlation ID: Correlation_ID.

Message #

Http request status: %1. Method: %2 Endpoint Uri: %3 Correlation ID: %4

Fields #

Name	Description
`Http_request_status` Int32	—
`Method` UnicodeString	—
`Endpoint_Uri` UnicodeString	—
`Correlation_ID` UnicodeString	—
`value` Int32	—
`EndpointUri` UnicodeString	—
`CorrelationID` UnicodeString	—

Event ID 1026 — Credential type: Credential_type Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Credential type: Credential_type Correlation ID: Correlation_ID.

Message #

Credential type: %1 Correlation ID: %2

Fields #

Name	Description
`Credential_type` Int32	—
`Correlation_ID` UnicodeString	—
`value` Int32	—
`CorrelationID` UnicodeString	—

Event ID 1027 — AadCloudAPPlugin managed logon flow for federated NGC user.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin managed logon flow for federated NGC user.

Message #

AadCloudAPPlugin managed logon flow for federated NGC user.

Event ID 1028 — AadCloudAPPlugin RefreshToken Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin RefreshToken Start.

Message #

AadCloudAPPlugin RefreshToken Start

Event ID 1029 — AadCloudAPPlugin RefreshToken Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin RefreshToken Stop.

Message #

AadCloudAPPlugin RefreshToken Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1030 — AadCloudAPPlugin RefreshToken Correlation ID: AadCloudAPPlugin_RefreshToken_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin RefreshToken Correlation ID: AadCloudAPPlugin_RefreshToken_Correlation_ID.

Message #

AadCloudAPPlugin RefreshToken Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_RefreshToken_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1031 — AadCloudAPPlugin encrypted OAuth response received

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin encrypted OAuth response received.

Message #

AadCloudAPPlugin encrypted OAuth response received

Event ID 1032 — Number of groups received: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Number of groups received: value.

Message #

Number of groups received: %1

Fields #

Name	Description
`value` Int32	—

Event ID 1033 — Validation needed: Validation_needed.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Validation needed: Validation_needed.

Message #

Validation needed: %1

Fields #

Name	Description
`Validation_needed` Int32	—
`value` Int32	—

Event ID 1034 — AadCloudAPPlugin GenericCallPkg Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GenericCallPkg Start.

Message #

AadCloudAPPlugin GenericCallPkg Start

Event ID 1035 — AadCloudAPPlugin GenericCallPkg Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin GenericCallPkg Stop.

Message #

AadCloudAPPlugin GenericCallPkg Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1081 — OAuth response error: OAuth_response_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

OAuth response error: OAuth_response_error.

Message #

OAuth response error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`OAuth_response_error` UnicodeString	—
`Error_description` UnicodeString	—
`CorrelationID` UnicodeString	—
`Error` UnicodeString	—
`ErrorDescription` UnicodeString	—

Event ID 1082 — Key error: Key_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Key error: Key_error.

Message #

Key error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Key_error` UnicodeString	—
`Error_description` UnicodeString	—
`CorrelationID` UnicodeString	—
`Error` UnicodeString	—
`ErrorDescription` UnicodeString	—

Event ID 1083 — Protected key error: Protected_key_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Protected key error: Protected_key_error.

Message #

Protected key error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Protected_key_error` UnicodeString	—
`Error_description` UnicodeString	—
`CorrelationID` UnicodeString	—
`Error` UnicodeString	—
`ErrorDescription` UnicodeString	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-1083-1061-sam-error-12294

Event ID 1084 — Http transport error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Http transport error. Status: Http_transport_error_Status Correlation ID: Correlation_ID.

Message #

Http transport error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Http_transport_error_Status` Int32	Http transport error. Status.
`Correlation_ID` UnicodeString	—
`Result` Int32	—
`Target` UnicodeString	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-event-id-2108-1084

Event ID 1085 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1086 — Get user realm failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get user realm failure. Status: Get_user_realm_failure_Status Correlation ID: Correlation_ID.

Message #

Get user realm failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Get_user_realm_failure_Status` HexInt32	Get user realm failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1087 — Get credential keys failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get credential keys failure. Status: Get_credential_keys_failure_Status Correlation ID: Correlation_ID.

Message #

Get credential keys failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Get_credential_keys_failure_Status` HexInt32	Get credential keys failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1088 — WSTrust response error: WSTrust_response_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

WSTrust response error: WSTrust_response_error.

Message #

WSTrust response error: %1
Error description: %2

Fields #

Name	Description
`WSTrust_response_error` UnicodeString	—
`Error_description` UnicodeString	—
`Error` UnicodeString	—
`ErrorDescription` UnicodeString	—

Event ID 1089 — Device is not cloud domain joined: Status.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Device is not cloud domain joined: Status.

Message #

Device is not cloud domain joined: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1090 — NGC nonce response error: NGC_nonce_response_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

NGC nonce response error: NGC_nonce_response_error.

Message #

NGC nonce response error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`NGC_nonce_response_error` UnicodeString	—
`Error_description` UnicodeString	—
`CorrelationID` UnicodeString	—
`Error` UnicodeString	—
`ErrorDescription` UnicodeString	—

Event ID 1091 — NGC auth ticket is not defined.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

NGC auth ticket is not defined. Error: Result.

Message #

NGC auth ticket is not defined. Error: %1

Fields #

Name	Description
`Result` Int32	—

Event ID 1092 — OAuth request retry.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

OAuth request retry. Correlation ID: OAuth_request_retry_Correlation_ID Retry: Retry.

Message #

OAuth request retry. Correlation ID: %1 Retry: %2

Fields #

Name	Description
`OAuth_request_retry_Correlation_ID` UnicodeString	OAuth request retry. Correlation ID.
`Retry` Int32	—
`CorrelationID` UnicodeString	—
`RetryNumber` Int32	—

Event ID 1093 — NGC call API returned error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

NGC call API returned error: Result.

Message #

NGC call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString	—
`Result` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-event-id-1093

Event ID 1094 — Refresh token failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token failure. Status: Refresh_token_failure_Status Correlation ID: Correlation_ID.

Message #

Refresh token failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Refresh_token_failure_Status` HexInt32	Refresh token failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1095 — Refresh token user SIDs don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token user SIDs don't match. Correlation ID: value.

Message #

Refresh token user SIDs don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1096 — Refresh token is expired.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token is expired. Correlation ID: value.

Message #

Refresh token is expired. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1097 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: Warning
Task: AadTokenBrokerPluginOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1097,
    "version": 0,
    "level": 3,
    "task": 103,
    "opcode": 0,
    "keywords": 4611686018427387952,
    "time_created": "2023-11-05T22:29:32.897824+00:00",
    "event_record_id": 8,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0002-97FA-A0593710DA01"
    },
    "execution": {
      "process_id": 7788,
      "thread_id": 7496
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Error": 2325807322,
    "ErrorMessage": "Upgrade default pawn task complete.",
    "AdditionalInformation": "Logged at UpdateDefaultPawn.cpp, line: 43, method: UpdateDefaultPawn::Apply."
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1098 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: Error
Task: AadTokenBrokerPluginOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1098,
    "version": 0,
    "level": 2,
    "task": 103,
    "opcode": 0,
    "keywords": 4611686018427387922,
    "time_created": "2026-03-14T21:11:21.909514+00:00",
    "event_record_id": 25,
    "correlation": {},
    "execution": {
      "process_id": 10584,
      "thread_id": 10312
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Error": 3399811278,
    "ErrorMessage": "User requested add account.",
    "AdditionalInformation": "UI flow is completed with error\r\nLogged at WebUITokenRequest.cpp, line: 180, method: WebUITokenRequest::FinalizeUIFlow.\r\n\r\nRequest: authority: https://login.microsoftonline.com/organizations, client: d3590ed6-52b3-4102-aeff-aad2292ab01c, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/d3590ed6-52b3-4102-aeff-aad2292ab01c, resource: , correlation ID (request): a315d45d-ad27-4338-a603-c6283cfa75d2"
  },
  "message": ""
}

Event ID 1099 — Code: Code OperationCode OperationMessage.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadTokenBrokerPluginOperation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`Code`	—
`OperationCode` UInt32	—
`OperationMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1100 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadAdalrtOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1101 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadAdalrtOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1102 — Code: Code OperationCode OperationMessage.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAdalrtOperation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`Code`	—
`OperationCode` UInt32	—
`OperationMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1103 — Can't decrypt OAuth response.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Can't decrypt OAuth response. Error: Cant_decrypt_OAuth_response_Error.

Message #

Can't decrypt OAuth response. Error: %1

Fields #

Name	Description
`Cant_decrypt_OAuth_response_Error` Int32	Can't decrypt OAuth response. Error.
`Result` Int32	—

Event ID 1104 — AAD Cloud AP plugin call API returned error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: Error
Task: AadCloudAPPluginOperation

Description

AAD Cloud AP plugin call API returned error: Result.

Message #

AAD Cloud AP plugin call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString	—
`Result` UInt32	1 returned error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1104,
    "version": 0,
    "level": 2,
    "task": 101,
    "opcode": 0,
    "keywords": 4611686018427387922,
    "time_created": "2022-04-07T16:53:02.149442+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-71B9-AAE09F4AD801"
    },
    "execution": {
      "process_id": 664,
      "thread_id": 668
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "API": "Plugin initialize",
    "Result": 3221521494
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1105 — Device registration API call API returned error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Device registration API call API returned error: Result.

Message #

Device registration API call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString	—
`Result` UInt32	—

Event ID 1106 — Number of security groups received value.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Number of security groups received value. CorrelationID: CorrelationID.

Message #

Number of security groups received %1. CorrelationID: %2

Fields #

Name	Description
`value` Int32	—
`CorrelationID` UnicodeString	—

Event ID 1107 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadTokenBrokerPluginOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1108 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadTokenBrokerPluginOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1109 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAdalrtOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1110 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAdalrtOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1111 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadAadtbOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1112 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadAadtbOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1113 — Code: Code OperationCode OperationMessage.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAadtbOperation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`Code`	—
`OperationCode` UInt32	—
`OperationMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1114 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAadtbOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1115 — Error: Error ErrorMessage AdditionalInformation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadAadtbOperation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32	—
`ErrorMessage` UnicodeString	—
`AdditionalInformation` UnicodeString	—

Event ID 1116 — Get Enterprise STS OAuth Info failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get Enterprise STS OAuth Info failure. Status: Status Correlation ID: CorrelationID.

Message #

Get Enterprise STS OAuth Info failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1117 — Enterprise STS Refresh token failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Refresh token failure. Status: Status Correlation ID: CorrelationID.

Message #

Enterprise STS Refresh token failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1118 — Enterprise STS Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Logon failure. Status: Enterprise_STS_Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Enterprise STS Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Enterprise_STS_Logon_failure_Status` HexInt32	Enterprise STS Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1119 — Enterprise STS OAuth Info response: Enterprise_STS_OAuth_Info_response.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Enterprise STS OAuth Info response: Enterprise_STS_OAuth_Info_response.

Message #

Enterprise STS OAuth Info response: %1.
Request status: %2

Fields #

Name	Description
`Enterprise_STS_OAuth_Info_response` UnicodeString	—
`Request_status` Int32	—
`Response` UnicodeString	—
`Status` Int32	— NTSTATUS reference

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1120 — Enterprise STS Refresh token is expired.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Refresh token is expired. Correlation ID: value.

Message #

Enterprise STS Refresh token is expired. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1121 — Enterprise STS RefreshToken Correlation ID: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

Enterprise STS RefreshToken Correlation ID: value.

Message #

Enterprise STS RefreshToken Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1122 — Refresh token subject don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token subject don't match. Correlation ID: value.

Message #

Refresh token subject don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1123 — AadCloudAPPlugin smart card logon for non-federated user.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin smart card logon for non-federated user.

Message #

AadCloudAPPlugin smart card logon for non-federated user.

Event ID 1124 — Device is DRS joined but Enterprise STS is disabled: Status.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Device is DRS joined but Enterprise STS is disabled: Status.

Message #

Device is DRS joined but Enterprise STS is disabled: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1125 — AadCloudAPPlugin loaded as surrogate, no key recovery

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin loaded as surrogate, no key recovery.

Message #

AadCloudAPPlugin loaded as surrogate, no key recovery

Event ID 1126 — AadCloudAPPlugin device is Enterprise joined

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin device is Enterprise joined.

Message #

AadCloudAPPlugin device is Enterprise joined

Event ID 1127 — AadCloudAPPlugin device P2P certificate update thread started

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin device P2P certificate update thread started.

Message #

AadCloudAPPlugin device P2P certificate update thread started

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1128 — AadCloudAPPlugin device P2P certificate update thread stopped

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin device P2P certificate update thread stopped.

Message #

AadCloudAPPlugin device P2P certificate update thread stopped

Event ID 1129 — AadCloudAPPlugin Uninitialize Stop

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin Uninitialize Stop.

Message #

AadCloudAPPlugin Uninitialize Stop

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1130 — AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: AadCloudAPPlugin_DeviceP2PCertificateUpdate_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: AadCloudAPPlugin_DeviceP2PCertificateUpdate_Correlation_ID.

Message #

AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_DeviceP2PCertificateUpdate_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1131 — Update P2P device certificate failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Update P2P device certificate failure. Status: Status Correlation ID: CorrelationID.

Message #

Update P2P device certificate failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1132 — AadCloudAPPlugin GetCertificateFromCred Correlation ID: AadCloudAPPlugin_GetCertificateFromCred_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetCertificateFromCred Correlation ID: AadCloudAPPlugin_GetCertificateFromCred_Correlation_ID.

Message #

AadCloudAPPlugin GetCertificateFromCred Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_GetCertificateFromCred_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1133 — Update P2P user certificate failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Update P2P user certificate failure. Status: Status Correlation ID: CorrelationID.

Message #

Update P2P user certificate failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1134 — AAD Cloud AP plugin call API returned error: Result.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AAD Cloud AP plugin call API returned error: Result.

Message #

AAD Cloud AP plugin call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString	—
`Result` UInt32	—

Event ID 1135 — AadCloudAPPlugin RenewCertificate Correlation ID: AadCloudAPPlugin_RenewCertificate_Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin RenewCertificate Correlation ID: AadCloudAPPlugin_RenewCertificate_Correlation_ID.

Message #

AadCloudAPPlugin RenewCertificate Correlation ID: %1

Fields #

Name	Description
`AadCloudAPPlugin_RenewCertificate_Correlation_ID` UnicodeString	—
`value` UnicodeString	—

Event ID 1136 — AadCloudAPPlugin AcceptPeerCertificate Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin AcceptPeerCertificate Start.

Message #

AadCloudAPPlugin AcceptPeerCertificate Start

Event ID 1137 — AadCloudAPPlugin AcceptPeerCertificate Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin AcceptPeerCertificate Stop.

Message #

AadCloudAPPlugin AcceptPeerCertificate Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1138 — AadCloudAPPlugin RenewCertificate Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin RenewCertificate Start.

Message #

AadCloudAPPlugin RenewCertificate Start

Event ID 1139 — AadCloudAPPlugin RenewCertificate Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin RenewCertificate Stop.

Message #

AadCloudAPPlugin RenewCertificate Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1140 — AadCloudAPPlugin GetCertificateFromCred Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin GetCertificateFromCred Start.

Message #

AadCloudAPPlugin GetCertificateFromCred Start

Event ID 1141 — AadCloudAPPlugin GetCertificateFromCred Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin GetCertificateFromCred Stop.

Message #

AadCloudAPPlugin GetCertificateFromCred Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1142 — Get token user names don't match.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get token user names don't match. Correlation ID: value.

Message #

Get token user names don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1143 — Generic Call Package call type: Generic_Call_Packate_call_type.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Generic Call Package call type: Generic_Call_Packate_call_type. Correlation ID: Correlation_ID.

Message #

Generic Call Package call type: %1. Correlation ID: %2

Fields #

Name	Description
`Generic_Call_Packate_call_type` Int32	—
`Correlation_ID` UnicodeString	—
`value` Int32	—
`CorrelationID` UnicodeString	—

Event ID 1144 — Realm discovery for: Method authority: EndpointUri fallback domain hint: CorrelationID useUpn: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Realm discovery for: Method authority: EndpointUri fallback domain hint: CorrelationID useUpn: value.

Message #

Realm discovery for: %2 authority: %3 fallback domain hint: %4 useUpn: %1

Fields #

Name	Description
`value` Int32	—
`Method` UnicodeString	—
`EndpointUri` UnicodeString	—
`CorrelationID` UnicodeString	—

Event ID 1145 — AAD Cloud AP plugin token needs refresh reason: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AAD Cloud AP plugin token needs refresh reason: value.

Message #

AAD Cloud AP plugin token needs refresh reason: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1146 — Token is not refreshed.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token is not refreshed. token time: NoOfTargets update time: RequestType.

Message #

Token is not refreshed. token time: %1 update time: %2

Fields #

Name	Description
`NoOfTargets` UInt64	—
`RequestType` UInt64	—

Event ID 1147 — AadCloudAPPlugin AssembleOpaqueData Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin AssembleOpaqueData Start.

Message #

AadCloudAPPlugin AssembleOpaqueData Start

Event ID 1148 — AadCloudAPPlugin AssembleOpaqueData Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin AssembleOpaqueData Stop.

Message #

AadCloudAPPlugin AssembleOpaqueData Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1149 — AadCloudAPPlugin DisassembleOpaqueData Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin DisassembleOpaqueData Start.

Message #

AadCloudAPPlugin DisassembleOpaqueData Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshoot-remote-desktop-disconnected-errors

Event ID 1150 — AadCloudAPPlugin DisassembleOpaqueData Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin DisassembleOpaqueData Stop.

Message #

AadCloudAPPlugin DisassembleOpaqueData Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1151 — AadCloudAPPlugin P2P device certificate update error: Status.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin P2P device certificate update error: Status.

Message #

AadCloudAPPlugin P2P device certificate update error: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1152 — AadCloudAPPlugin device certificate key error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin device certificate key error: Result.

Message #

AadCloudAPPlugin device certificate key error: %1

Fields #

Name	Description
`Result` Int32	—

Event ID 1153 — AadCloudAPPlugin device certificate not available for logon: value.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin device certificate not available for logon: value.

Message #

AadCloudAPPlugin device certificate not available for logon: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1154 — Password expiration claims.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Password expiration claims. Seconds: Password_expiration_claims_Seconds URI: URI.

Message #

Password expiration claims. Seconds: %1 URI: %2

Fields #

Name	Description
`Password_expiration_claims_Seconds` Int32	Password expiration claims. Seconds.
`URI` UnicodeString	—
`seconds` Int32	—

Event ID 1155 — Logon with session key failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon with session key failure. Retrying with device auth. Status: Status Correlation ID: CorrelationID.

Message #

Logon with session key failure. Retrying with device auth. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1156 — Password expiration fields.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Password expiration fields. Status: Password_expiration_fields_Status Date: Date URI: URI.

Message #

Password expiration fields. Status: %1 Date: %2 URI: %3

Fields #

Name	Description
`Password_expiration_fields_Status` HexInt32	Password expiration fields. Status.
`Date` FILETIME	—
`URI` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`ExpiryTime` FILETIME	—
`PasswordChangeURI` UnicodeString	—

Event ID 1157 — AadCloudAPPlugin PostLogonProcessing Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin PostLogonProcessing Start.

Message #

AadCloudAPPlugin PostLogonProcessing Start

Event ID 1158 — AadCloudAPPlugin PostLogonProcessing Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin PostLogonProcessing Stop.

Message #

AadCloudAPPlugin PostLogonProcessing Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1159 — AadCloudAPPlugin S4U logon failed.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin S4U logon failed. Status: AadCloudAPPlugin_S2U_logon_failed_Status.

Message #

AadCloudAPPlugin S4U logon failed. Status: %1

Fields #

Name	Description
`AadCloudAPPlugin_S2U_logon_failed_Status` HexInt32	AadCloudAPPlugin S2U logon failed. Status.
`Status` HexInt32	— NTSTATUS reference

Event ID 1160 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1161 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1162 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1163 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1164 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1165 — Logon failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Logon_failure_Status` HexInt32	Logon failure. Status.
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1200 — BrowserCore operation started

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: BrowserCoreOperation
Opcode: Start

Description

BrowserCore operation started.

Message #

BrowserCore operation started

Event ID 1201 — BrowserCore operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: BrowserCoreOperation
Opcode: Stop

Description

BrowserCore operation completed successfully.

Message #

BrowserCore operation completed successfully.
Method: %1
CorrelationID: %2

Fields #

Name	Description
`Method` UnicodeString	—
`CorrelationID` UnicodeString	—

Event ID 1202 — BrowserCore operation completed with a failure.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: BrowserCoreOperation
Opcode: Stop

Description

BrowserCore operation completed with a failure.

Message #

BrowserCore operation completed with a failure.
Error: %1
Error Message: %2
Method: %3
CorrelationID: %4

Fields #

Name	Description
`Error`	—
`Error_Message`	—
`Result` Int32	—
`ErrorMessage` UnicodeString	—
`Method` UnicodeString	—
`CorrelationID` UnicodeString	—

Event ID 1203 — BrowserCore inner operation FunctionName completed with error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: BrowserCoreOperation

Description

BrowserCore inner operation FunctionName completed with error: Result.

Message #

BrowserCore inner operation %2 completed with error: %1

Fields #

Name	Description
`Result` Int32	—
`FunctionName` AnsiString	—

Event ID 1204 — AadCloudAPPlugin LookupSIDFromIdentityName Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin LookupSIDFromIdentityName Start.

Message #

AadCloudAPPlugin LookupSIDFromIdentityName Start

Event ID 1205 — AadCloudAPPlugin LookupSIDFromIdentityName Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin LookupSIDFromIdentityName Stop.

Message #

AadCloudAPPlugin LookupSIDFromIdentityName Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1206 — AadCloudAPPlugin LookupIdentityFromSIDName Start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin LookupIdentityFromSIDName Start.

Message #

AadCloudAPPlugin LookupIdentityFromSIDName Start

Event ID 1207 — AadCloudAPPlugin LookupIdentityFromSIDName Stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin LookupIdentityFromSIDName Stop.

Message #

AadCloudAPPlugin LookupIdentityFromSIDName Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1208 — AadCloudAPPlugin LookupSIDFromIdentity Identity: AadCloudAPPlugin_LookupSIDFromIdentity_Identity Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin LookupSIDFromIdentity Identity: AadCloudAPPlugin_LookupSIDFromIdentity_Identity Correlation ID: Correlation_ID.

Message #

AadCloudAPPlugin LookupSIDFromIdentity Identity: %1 Correlation ID: %2

Fields #

Name	Description
`AadCloudAPPlugin_LookupSIDFromIdentity_Identity` UnicodeString	—
`Correlation_ID` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—

Event ID 1209 — AadCloudAPPlugin LookupIdentityFromSID SID: AadCloudAPPlugin_LookupIdentityFromSID_SID Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

AadCloudAPPlugin LookupIdentityFromSID SID: AadCloudAPPlugin_LookupIdentityFromSID_SID Correlation ID: Correlation_ID.

Message #

AadCloudAPPlugin LookupIdentityFromSID SID: %1 Correlation ID: %2

Fields #

Name	Description
`AadCloudAPPlugin_LookupIdentityFromSID_SID` UnicodeString	—
`Correlation_ID` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—

Event ID 1210 — AadCloudAPPlugin password expired, password change URI: value.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin password expired, password change URI: value.

Message #

AadCloudAPPlugin password expired, password change URI: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1211 — Writing RunRecovery registry value failed.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Writing RunRecovery registry value failed.

Message #

Writing RunRecovery registry value failed.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1212 — Enterprise logon.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise logon. Password is expired.

Message #

Enterprise logon. Password is expired.
Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference
`Correlation_ID` UnicodeString	—
`CorrelationID` UnicodeString	—

Event ID 1213 — WamExtension process token operation started

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Description

WamExtension process token operation started.

Message #

WamExtension process token operation started.

Event ID 1214 — WamExtension process token operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension process token operation completed successfully.

Message #

WamExtension process token operation completed successfully

Event ID 1215 — WamExtension process token operation completed with error: Data.

Provider: Microsoft-Windows-AAD
Channel: Operational
Level: Error
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension process token operation completed with error: Data.

Message #

WamExtension process token operation completed with error: %1

Fields #

Name	Description
`Data`	WamExtension process token operation completed with error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1215,
    "version": 0,
    "level": 2,
    "task": 107,
    "opcode": 2,
    "keywords": 4611686018427387922,
    "time_created": "2022-04-07T16:44:49.386586+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 2080,
      "thread_id": 2748
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "Result",
      "Value": "\u0004�\u0004�"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1216 — WamExtension device authentication call status: Result Correlation ID: Target.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Description

WamExtension device authentication call status: Result Correlation ID: Target.

Message #

WamExtension device authentication call status: %1 Correlation ID: %2

Fields #

Name	Description
`Result` Int32	—
`Target` UnicodeString	—

Event ID 1217 — Get device token.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Get device token. Resource: Get_device_token_Resource ClientID: ClientID Scope: Scope.

Message #

Get device token. Resource: %1 ClientID: %2 Scope: %3

Fields #

Name	Description
`Get_device_token_Resource` UnicodeString	Get device token. Resource.
`ClientID` UnicodeString	—
`Scope` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—
`value3` UnicodeString	—

Event ID 1218 — StartFidoAuthenticationSession start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

StartFidoAuthenticationSession start.

Message #

StartFidoAuthenticationSession start

Event ID 1219 — StartFidoAuthenticationSession stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

StartFidoAuthenticationSession stop.

Message #

StartFidoAuthenticationSession stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1220 — CloseFidoAuthenticationSession start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

CloseFidoAuthenticationSession start.

Message #

CloseFidoAuthenticationSession start

Event ID 1221 — CloseFidoAuthenticationSession stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

CloseFidoAuthenticationSession stop.

Message #

CloseFidoAuthenticationSession stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1222 — GetClientData start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

GetClientData start.

Message #

GetClientData start

Event ID 1223 — GetClientData stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

GetClientData stop.

Message #

GetClientData stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1224 — SignClientDataFido start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

SignClientDataFido start.

Message #

SignClientDataFido start

Event ID 1225 — SignClientDataFido stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

SignClientDataFido stop.

Message #

SignClientDataFido stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1226 — ChangePin start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

ChangePin start.

Message #

ChangePin start

Event ID 1227 — ChangePin stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

ChangePin stop.

Message #

ChangePin stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1228 — GetSerializedAuthBuffer start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

GetSerializedAuthBuffer start.

Message #

GetSerializedAuthBuffer start

Event ID 1229 — GetSerializedAuthBuffer stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

GetSerializedAuthBuffer stop.

Message #

GetSerializedAuthBuffer stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1230 — AuthHelper call API returned error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AuthHelper

Description

AuthHelper call API returned error: Result.

Message #

AuthHelper call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString	—
`Result` UInt32	—

Event ID 1231 — AadCloudAPPlugin Resource infomation: AadCloudAPPlugin_Resource_infomation.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin Resource infomation: AadCloudAPPlugin_Resource_infomation.

Message #

AadCloudAPPlugin Resource infomation: %1.
Request status: %2

Fields #

Name	Description
`AadCloudAPPlugin_Resource_infomation` UnicodeString	—
`Request_status` Int32	—
`Response` UnicodeString	—
`Status` Int32	— NTSTATUS reference

Event ID 1232 — AadCloudAPPlugin RBAC authorization code response: Response.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin RBAC authorization code response: Response.

Message #

AadCloudAPPlugin RBAC authorization code response: %1.
Request status: %2

Fields #

Name	Description
`Response` UnicodeString	—
`Status` Int32	— NTSTATUS reference

Event ID 1233 — AadCloudAPPlugin User access control role: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin User access control role: value.

Message #

AadCloudAPPlugin User access control role: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1234 — AadCloudAPPlugin using resource id from the Idtoken: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AadCloudAPPlugin using resource id from the Idtoken: value.

Message #

AadCloudAPPlugin using resource id from the Idtoken: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1235 — RBAC Status: RBAC_Status Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

RBAC Status: RBAC_Status Correlation ID: Correlation_ID.

Message #

RBAC Status: %1 Correlation ID: %2

Fields #

Name	Description
`RBAC_Status` HexInt32	—
`Correlation_ID` UnicodeString	—
`Status` HexInt32	— NTSTATUS reference
`CorrelationID` UnicodeString	—

Event ID 1236 — Failed to create the resource id

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Failed to create the resource id.

Message #

Failed to create the resource id

Event ID 1237 — Device is configured for RBAC authorization

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Device is configured for RBAC authorization.

Message #

Device is configured for RBAC authorization

Event ID 1238 — Not sending the client certificate as it is optional on the server

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Not sending the client certificate as it is optional on the server.

Message #

Not sending the client certificate as it is optional on the server

Event ID 1239 — Doing RBAC logon of the device type: value.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Doing RBAC logon of the device type: value.

Message #

Doing RBAC logon of the device type: %1

Fields #

Name	Description
`value` UnicodeString	—

Event ID 1240 — Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate.

Message #

Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate

Event ID 1241 — On-prem tgt error: Onprem_tgt_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

On-prem tgt error: Onprem_tgt_error.

Message #

On-prem tgt error: %1

Fields #

Name	Description
`Onprem_tgt_error` UnicodeString	On-prem tgt error.
`value` UnicodeString	—

Event ID 1242 — Added user to admins security group

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Added user to admins security group.

Message #

Added user to admins security group

Event ID 1243 — Removed user from admins security group

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Removed user from admins security group.

Message #

Removed user from admins security group

Event ID 1244 — Security groups were not loaded.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Security groups were not loaded. Error: Status.

Message #

Security groups were not loaded. Error: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1245 — Security groups were not updated.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Security groups were not updated. Error: Status.

Message #

Security groups were not updated. Error: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1246 — User sid: User_sid Group sids: Group_sids.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

User sid: %1
Group sids:
%2

Fields #

Name	Description
`User_sid` UnicodeString	—
`Group_sids` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—

Event ID 1247 — RunRecovery registry value (Context) successfully written.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

RunRecovery registry value (Context) successfully written.

Message #

RunRecovery registry value (%1) successfully written.
Context: %2
Reason: %3

Fields #

Name	Description
`Context` UnicodeString	—
`Reason`	—
`value` Int32	—
`Result` Int32	—

Event ID 1248 — AuthHelper auth buff local nonce

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AuthHelper

Description

AuthHelper auth buff local nonce.

Message #

AuthHelper auth buff local nonce

Event ID 1249 — Cloud tgt error: Cloud_tgt_error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Cloud tgt error: Cloud_tgt_error.

Message #

Cloud tgt error: %1

Fields #

Name	Description
`Cloud_tgt_error` UnicodeString	—
`value` UnicodeString	—

Event ID 1250 — DoGetToken Diagnostic Event.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

DoGetToken Diagnostic Event.

Message #

DoGetToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoGetToken Diagnostic Event] Result.
`User_Identity`	[DoGetToken Diagnostic Event] User Identity.
`Credential_Type`	[DoGetToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoGetToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoGetToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoGetToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoGetToken Diagnostic Event] HTTP Method.
`ErrorCode` UnicodeString	[DoGetToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoGetToken Diagnostic Event] Error Description.
`UserIdentity` UnicodeString	—
`CredentialType` Int32	— Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`CorrelationID` UnicodeString	—
`EndpointUri` UnicodeString	—
`Method` UnicodeString	—
`HTTPTransportError` Int32	—
`HTTPStatus` Int32	—
`ErrorDescription` UnicodeString	—

Event ID 1251 — DoGetEnterpriseToken Diagnostic Event.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

DoGetEnterpriseToken Diagnostic Event.

Message #

DoGetEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoGetEnterpriseToken Diagnostic Event] Result.
`User_Identity`	[DoGetEnterpriseToken Diagnostic Event] User Identity.
`Credential_Type`	[DoGetEnterpriseToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoGetEnterpriseToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoGetEnterpriseToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoGetEnterpriseToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoGetEnterpriseToken Diagnostic Event] HTTP Method.
`ErrorCode` UnicodeString	[DoGetEnterpriseToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoGetEnterpriseToken Diagnostic Event] Error Description.
`UserIdentity` UnicodeString	—
`CredentialType` Int32	— Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`CorrelationID` UnicodeString	—
`EndpointUri` UnicodeString	—
`Method` UnicodeString	—
`HTTPTransportError` Int32	—
`HTTPStatus` Int32	—
`ErrorDescription` UnicodeString	—

Event ID 1252 — DoRefreshToken Diagnostic Event.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

DoRefreshToken Diagnostic Event.

Message #

DoRefreshToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoRefreshToken Diagnostic Event] Result.
`User_Identity`	[DoRefreshToken Diagnostic Event] User Identity.
`Credential_Type`	[DoRefreshToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoRefreshToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoRefreshToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoRefreshToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoRefreshToken Diagnostic Event] HTTP Method.
`ErrorCode` UnicodeString	[DoRefreshToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoRefreshToken Diagnostic Event] Error Description.
`UserIdentity` UnicodeString	—
`CredentialType` Int32	— Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`NewToken` Boolean	—
`CorrelationID` UnicodeString	—
`EndpointUri` UnicodeString	—
`Method` UnicodeString	—
`HTTPTransportError` Int32	—
`HTTPStatus` Int32	—
`ErrorDescription` UnicodeString	—

Event ID 1253 — DoRefreshEnterpriseToken Diagnostic Event.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

DoRefreshEnterpriseToken Diagnostic Event.

Message #

DoRefreshEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoRefreshEnterpriseToken Diagnostic Event] Result.
`User_Identity`	[DoRefreshEnterpriseToken Diagnostic Event] User Identity.
`Credential_Type`	[DoRefreshEnterpriseToken Diagnostic Event] Credential Type.
`Correlation_ID`	[DoRefreshEnterpriseToken Diagnostic Event] Correlation ID.
`Endpoint_Uri`	[DoRefreshEnterpriseToken Diagnostic Event] Endpoint Uri.
`HTTP_Status`	[DoRefreshEnterpriseToken Diagnostic Event] HTTP Status.
`HTTP_Method`	[DoRefreshEnterpriseToken Diagnostic Event] HTTP Method.
`ErrorCode` UnicodeString	[DoRefreshEnterpriseToken Diagnostic Event] ErrorCode.
`Error_Description`	[DoRefreshEnterpriseToken Diagnostic Event] Error Description.
`UserIdentity` UnicodeString	—
`CredentialType` Int32	— Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`NewToken` Boolean	—
`CorrelationID` UnicodeString	—
`EndpointUri` UnicodeString	—
`Method` UnicodeString	—
`HTTPTransportError` Int32	—
`HTTPStatus` Int32	—
`ErrorDescription` UnicodeString	—

Event ID 1254 — Response content type: Response_content_type.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Response content type: Response_content_type.

Message #

Response content type: %1

Fields #

Name	Description
`Response_content_type` UnicodeString	—
`value` UnicodeString	—

Event ID 1255 — AD TGT: AD_TGT Cloud TGT: Cloud_TGT.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

AD TGT: AD_TGT Cloud TGT: Cloud_TGT.

Message #

AD TGT: %1 Cloud TGT: %2

Fields #

Name	Description
`AD_TGT` UInt32	—
`Cloud_TGT` UInt32	—
`NoOfTargets` UInt32	—
`RequestType` UInt32	—

Event ID 1256 — P2P certificate update error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

P2P certificate update error. Status: P2P_certificate_update_error_Status Correlation ID: Correlation_ID.

Message #

P2P certificate update error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`P2P_certificate_update_error_Status` Int32	P2P certificate update error. Status.
`Correlation_ID` UnicodeString	—
`Result` Int32	—
`Target` UnicodeString	—

Event ID 1257 — Credbuffer correlation ID: Credbuffer_correlation_ID Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

Credbuffer correlation ID: Credbuffer_correlation_ID Correlation ID: Correlation_ID.

Message #

Credbuffer correlation ID: %1 Correlation ID: %2

Fields #

Name	Description
`Credbuffer_correlation_ID` UnicodeString	—
`Correlation_ID` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—

Event ID 1258 — CA cert hash (keyID): CA_cert_hash_keyID Correlation ID: Correlation_ID.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Description

CA cert hash (keyID): CA_cert_hash_keyID Correlation ID: Correlation_ID.

Message #

CA cert hash (keyID): %1 Correlation ID: %2

Fields #

Name	Description
`CA_cert_hash_keyID` UnicodeString	CA cert hash (keyID).
`Correlation_ID` UnicodeString	—
`value1` UnicodeString	—
`value2` UnicodeString	—

Event ID 1259 — CA certificate update error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

CA certificate update error. Status: CA_certificate_update_error_Status Correlation ID: Correlation_ID.

Message #

CA certificate update error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`CA_certificate_update_error_Status` Int32	CA certificate update error. Status.
`Correlation_ID` UnicodeString	—
`Result` Int32	—
`Target` UnicodeString	—

Event ID 1260 — RetryGetClientData start

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Start

Description

RetryGetClientData start.

Message #

RetryGetClientData start

Event ID 1261 — RetryGetClientData stop.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AuthHelper
Opcode: Stop

Description

RetryGetClientData stop.

Message #

RetryGetClientData stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	— NTSTATUS reference

Event ID 1262 — Binding key tag check failed: Binding_key_tag_check_failed.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

Binding key tag check failed: Binding_key_tag_check_failed.

Message #

Binding key tag check failed: %1

Fields #

Name	Description
`Binding_key_tag_check_failed` HexInt32	—
`Status` HexInt32	— NTSTATUS reference

Event ID 1263 — BrowserCore inner operation FunctionName with account pairwiseID PairwiseID not found error.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: BrowserCoreOperation

Description

BrowserCore inner operation FunctionName with account pairwiseID PairwiseID not found error.

Message #

BrowserCore inner operation %2 with account pairwiseID %1 not found error

Fields #

Name	Description
`PairwiseID` UnicodeString	—
`FunctionName` AnsiString	—

Event ID 1264 — Token binding key created.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding key created.

Message #

Token binding key created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—

Event ID 1265 — WamExtension preprocess token operation started.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Description

WamExtension preprocess token operation started.

Message #

WamExtension preprocess token operation started.

Event ID 1266 — WamExtension preprocess token operation completed successfully

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension preprocess token operation completed successfully.

Message #

WamExtension preprocess token operation completed successfully

Event ID 1267 — WamExtension preprocess token operation completed with error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension preprocess token operation completed with error: Result.

Message #

WamExtension preprocess token operation completed with error: %1

Fields #

Name	Description
`Result` Int32	—

Event ID 1268 — WamExtension postprocess token operation started.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Description

WamExtension postprocess token operation started.

Message #

WamExtension postprocess token operation started.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString	—

Event ID 1269 — WamExtension postprocess token operation completed successfully.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension postprocess token operation completed successfully.

Message #

WamExtension postprocess token operation completed successfully.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString	—

Event ID 1270 — WamExtension postprocess token operation completed with error: Result.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: WamExtensionOperation
Opcode: Stop

Description

WamExtension postprocess token operation completed with error: Result.

Message #

WamExtension postprocess token operation completed with error: %2.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString	—
`Result` Int32	—

Event ID 1271 — Token binding claim(s) included in the request.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claim(s) included in the request. Correlation ID: CorrelationID.

Message #

Token binding claim(s) included in the request. Correlation ID: %1

Fields #

Name	Description
`CorrelationID` UnicodeString	—

Event ID 1272 — Token binding key is not healthy and needs to be re-created.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding key is not healthy and needs to be re-created.

Message #

Token binding key is not healthy and needs to be re-created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4
Test result: %5

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—
`KeyTestResult` Int32	—

Event ID 1273 — Token binding claims need to be re-generated due to changes in attestation key(s).

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims need to be re-generated due to changes in attestation key(s).

Message #

Token binding claims need to be re-generated due to changes in attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—

Event ID 1274 — Token binding claims generated.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims generated.

Message #

Token binding claims generated.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—

Event ID 1275 — Token binding claims generated for UI request.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims generated for UI request.

Message #

Token binding claims generated for UI request.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—

Event ID 1276 — Token binding claims count: ClaimsCount.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims count: ClaimsCount.

Message #

Token binding claims count: %1

Fields #

Name	Description
`ClaimsCount` Int32	—

Event ID 1277 — KeyGuard availability detection failed.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

KeyGuard availability detection failed. Error: Result.

Message #

KeyGuard availability detection failed. Error: %1

Fields #

Name	Description
`Result` Int32	—

Event ID 1278 — KeyGuard with attestation support is not detected.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

KeyGuard with attestation support is not detected.

Message #

KeyGuard with attestation support is not detected.

Event ID 1279 — Token binding claims of type KeyType could not be generated because AIK does not exist.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims of type KeyType could not be generated because AIK does not exist.

Message #

Token binding claims of type %1 could not be generated because AIK does not exist.
Join Type: %2
Tenant ID: %3

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`JoinType` Int32	—
`TenantId` UnicodeString	—

Event ID 1280 — PRT session key needs to be rolled.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: AadCloudAPPluginOperation

Description

PRT session key needs to be rolled.

Message #

PRT session key needs to be rolled.
Reason: %1

Fields #

Name	Description
`Reason` UnicodeString	—
`RollReason` UnicodeString	—

Event ID 1281 — Token binding key deleted.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding key deleted.

Message #

Token binding key deleted.
Key: %1

Fields #

Name	Description
`Key` UnicodeString	—

Event ID 1282 — SHR property in request is not allowed.

Provider: Microsoft-Windows-AAD
Channel: Operational
Task: WamExtensionOperation

Description

SHR property in request is not allowed. Property: PropertyName.

Message #

SHR property in request is not allowed. Property: %1

Fields #

Name	Description
`PropertyName` UnicodeString	—

Event ID 1283 — Invalid registry value was ignored.

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Invalid registry value was ignored.

Message #

Invalid registry value was ignored.
Location: %1
Value name: %2
Value: %3

Fields #

Name	Description
`RegistryLocation` UnicodeString	—
`RegistryValueName` UnicodeString	—
`Value` HexInt32	—

Event ID 1284 — Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).

Provider: Microsoft-Windows-AAD
Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).

Message #

Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	— Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString	—
`Resource` UnicodeString	—
`Scope` UnicodeString	—