Microsoft-Windows-CertificateServicesClient-AutoEnrollment

23 events across 2 channels

Event	Title	Channel
1	Automatic certificate enrollment for Context failed to download certificates for …	Operational
2	Automatic certificate enrollment for Context started	Operational
3	Automatic certificate enrollment for Context completed	Operational
4	Automatic certificate enrollment for Context invoked the enrollment API	Operational
5	Automatic certificate enrollment for Context returned from the enrollment API	Operational
6	Automatic certificate enrollment for local system failed (0x8007054b) The …	Application
6	Automatic certificate enrollment for Context failed (ErrorCode)	Operational
15	Automatic certificate enrollment for Context failed to contact the active …	Operational
64	Certificate for Context with Thumbprint ObjId is about to expire or already …	Operational
1073741825	Automatic certificate enrollment for Context failed to download certificates for …	Operational
1073741826	Automatic certificate enrollment for {Context} started.	Operational
1073741827	Automatic certificate enrollment for {Context} completed.	Operational
1073741828	Automatic certificate enrollment for {Context} invoked the enrollment API.	Operational
1073741829	Automatic certificate enrollment for {Context} returned from the enrollment API.	Operational
1073741830	Automatic certificate enrollment for Context failed (ErrorCode) ErrorMsg.	Operational
2147483663	Automatic certificate enrollment for Context failed to contact the active …	Operational
2147483712	Certificate for Context with Thumbprint ObjId is about to expire or already …	Operational
3221225473	Automatic certificate enrollment for {Context} failed to download certificates …	Operational
3221225474	Automatic certificate enrollment for Context started.	Operational
3221225475	Automatic certificate enrollment for Context completed.	Operational
3221225476	Automatic certificate enrollment for Context invoked the enrollment API.	Operational
3221225477	Automatic certificate enrollment for Context returned from the enrollment API.	Operational
3221225478	Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.	Operational

Event ID 1: Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode)

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`StoreName` UnicodeString
`LdapStore` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2: Automatic certificate enrollment for Context started

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 3: Automatic certificate enrollment for Context completed

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 4: Automatic certificate enrollment for Context invoked the enrollment API

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 5: Automatic certificate enrollment for Context returned from the enrollment API

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 6: Automatic certificate enrollment for local system failed (0x8007054b) The specified domain either does not exist or could not be contacted.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Application
Level: Error

Fields #

Name	Description
`Context`
`ErrorCode`
`ErrorMsg`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertificateServicesClient-AutoEnrollment",
    "guid": "{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}",
    "event_source_name": "AutoEnrollment",
    "event_id": 6,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T08:15:12.653840+00:00",
    "event_record_id": 112,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "local system",
    "ErrorCode": "0x8007054b",
    "ErrorMsg": "The specified domain either does not exist or could not be contacted.\r\n"
  },
  "message": "Automatic certificate enrollment for local system failed (0x8007054b) The specified domain either does not exist or could not be contacted.\r\n."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 6: Automatic certificate enrollment for Context failed (ErrorCode)

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 15: Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode)

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 64: Certificate for Context with Thumbprint ObjId is about to expire or already expired

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ObjId` UnicodeString

Event ID 1073741825: Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode).

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode). ErrorMsg.

Message #

Automatic certificate enrollment for %1 failed to download certificates for %2 store from %3 (%4). %5

Fields #

Name	Description
`Context` UnicodeString	Automatic certificate enrollment for
`StoreName` UnicodeString	failed to download certificates for
`LdapStore` UnicodeString	store from
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 1073741826: Automatic certificate enrollment for {Context} started.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} started.

Message #

Automatic certificate enrollment for {Context} started.

Fields #

Name	Description
`Context`

Event ID 1073741827: Automatic certificate enrollment for {Context} completed.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} completed.

Message #

Automatic certificate enrollment for {Context} completed.

Fields #

Name	Description
`Context`

Event ID 1073741828: Automatic certificate enrollment for {Context} invoked the enrollment API.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} invoked the enrollment API.

Message #

Automatic certificate enrollment for {Context} invoked the enrollment API.

Fields #

Name	Description
`Context`

Event ID 1073741829: Automatic certificate enrollment for {Context} returned from the enrollment API.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} returned from the enrollment API.

Message #

Automatic certificate enrollment for {Context} returned from the enrollment API.

Fields #

Name	Description
`Context`

Event ID 1073741830: Automatic certificate enrollment for Context failed (ErrorCode) ErrorMsg.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context failed (ErrorCode) ErrorMsg.

Message #

Automatic certificate enrollment for %1 failed (%2) %3.

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2147483663: Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode).

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode). ErrorMsg Enrollment will not be performed.

Message #

Automatic certificate enrollment for %1 failed to contact the active directory (%2). %3 Enrollment will not be performed.

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2147483712: Certificate for Context with Thumbprint ObjId is about to expire or already expired.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Certificate for Context with Thumbprint ObjId is about to expire or already expired.

Message #

Certificate for %1 with Thumbprint %2 is about to expire or already expired.

Fields #

Name	Description
`Context` UnicodeString
`ObjId` UnicodeString

Event ID 3221225473: Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}).

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}). {ErrorMsg}.

Message #

Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}). {ErrorMsg}

Fields #

Name	Description
`Context`
`StoreName`
`LdapStore`
`ErrorCode`
`ErrorMsg`

Event ID 3221225474: Automatic certificate enrollment for Context started.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context started.

Message #

Automatic certificate enrollment for %1 started.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225475: Automatic certificate enrollment for Context completed.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context completed.

Message #

Automatic certificate enrollment for %1 completed.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225476: Automatic certificate enrollment for Context invoked the enrollment API.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context invoked the enrollment API.

Message #

Automatic certificate enrollment for %1 invoked the enrollment API.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225477: Automatic certificate enrollment for Context returned from the enrollment API.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for Context returned from the enrollment API.

Message #

Automatic certificate enrollment for %1 returned from the enrollment API.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225478: Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Channel: Operational

Description

Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.

Message #

Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.

Fields #

Name	Description
`Context`
`ErrorCode`
`ErrorMsg`

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f0db7ef8-b6f3-4005-9937-feb77b9e1b43

Defined in pautoenr.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)