Fields

Example Event

system:
  provider: Microsoft-Windows-CertificateServicesClient-CertEnroll
  guid: '{54164045-7C50-4905-963F-E5BC1EEF0CCA}'
  event_source_name: CertEnroll
  event_id: 15
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T08:15:12.606960+00:00'
  event_record_id: 111
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Context: Local system
  ErrorCode: 'The specified domain either does not exist or could not be contacted.
    0x8007054b (WIN32: 1355 ERROR_NO_SUCH_DOMAIN)'
message: Certificate enrollment for Local system failed to retrieve certificate template
  information from the Policy Server. Enrollment was not performed.

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Microsoft-Windows-CertificateServicesClient-CertEnroll
  guid: '{54164045-7C50-4905-963F-E5BC1EEF0CCA}'
  event_source_name: CertEnroll
  event_id: 67
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T08:15:12.606960+00:00'
  event_record_id: 110
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Context: Local system
  ServerID: 'The specified domain either does not exist or could not be contacted.
    0x8007054b (WIN32: 1355 ERROR_NO_SUCH_DOMAIN)'
  ErrorCode: ''
message: 'Certificate enrollment for Local system failed to load policy from policy
  servers with ID  The specified domain either does not exist or could not be contacted.
  0x8007054b (WIN32: 1355 ERROR_NO_SUCH_DOMAIN) ()'

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Microsoft-Windows-CertificateServicesClient-CertEnroll
  guid: '{54164045-7C50-4905-963F-E5BC1EEF0CCA}'
  event_source_name: CertEnroll
  event_id: 68
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T08:15:12.606960+00:00'
  event_record_id: 109
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Context: Local system
  ServerID: '{67576419-F9FE-45FF-B3DA-10013334C041}'
  ErrorCode: 'The specified domain either does not exist or could not be contacted.
    0x8007054b (WIN32: 1355 ERROR_NO_SUCH_DOMAIN)'
message: 'Certificate enrollment for Local system failed in authentication to policy
  servers with ID {67576419-F9FE-45FF-B3DA-10013334C041}  (The specified domain either
  does not exist or could not be contacted. 0x8007054b (WIN32: 1355 ERROR_NO_SUCH_DOMAIN))'

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Microsoft-Windows-CertificateServicesClient-CertEnroll
  guid: '{54164045-7C50-4905-963F-E5BC1EEF0CCA}'
  event_source_name: CertEnroll
  event_id: 70
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2022-04-07T08:15:12.606960+00:00'
  event_record_id: 108
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Context: Local system
  ServerURL: '{67576419-F9FE-45FF-B3DA-10013334C041}'
message: Certificate enrollment for Local system failed because no valid policy can
  be obtained from policy servers with ID {67576419-F9FE-45FF-B3DA-10013334C041}

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Certificate enrollment for %1 received a %2 certificate with request ID %4 from %3 when retrieving pending requests.

Fields

Message

Certificate enrollment for %1 attempted to enroll for a %2 certificate with request ID %4 from certification authority %3.  The request is pending.

Fields

Message

Certificate enrollment for %1 attempted to renew a %2 certificate with request ID %4 from certification authority %3.  The request is pending.

Fields

Message

Certificate enrollment for {Context} successfully installed a {TemplateName} certificate when retrieving pending requests.  User interaction was required.

Fields

Message

Certificate enrollment for {Context} reused the private key when requesting a {TemplateName} certificate.

Fields

Message

Certificate enrollment for {Context} successfully received a {TemplateName} certificate.

Fields

Message

Certificate enrollment for %1 could not access local resources or retrieve %2 certificate template information (%3).  Enrollment was not performed.

Fields

Message

Certificate enrollment for %1 could not find any valid certificate templates.  Enrollment was not performed.

Fields

Message

Certificate enrollment for {Context} removed pending certificate requests that have expired or are obsolete.

Fields

Message

Certificate enrollment for %1 archived or deleted, from the Personal certificate store, certificates that have expired, or been revoked or superseded.

Fields

Message

Certificate enrollment for %1 successfully received a %2 certificate with request ID %4 from certification authority %3.

Fields

Message

Certificate enrollment for %1 successfully renewed a %2 certificate with request ID %4 from certification authority %3.

Fields

Message

Certificate enrollment for %1 failed to update the %2 certificate in the Personal certificate store due to one of the following: 
 	Cannot find %2 certificate template from Active Directory.
 	Enrollment access to this template is not allowed.

Fields

Message

Certificate enrollment for %1 was cancelled by the user.

Fields

Message

Certificate enrollment for %1 was cancelled by the user when requesting a %2 certificate.

Fields

Message

Certificate enrollment for %1 attempted to retrieve a %2 certificate from %3.  The certificate request is still pending.

Fields

Message

Certificate enrollment for %1 deleted certificates that have expired, or have been revoked or superseded from the user object in Active Directory.

Fields

Message

To prevent simultaneous renewal or enrollment from another computer, certificate enrollment for %1 to renew or enroll for a %2 certificate has been skipped.

Fields

Message

Certificate enrollment for %1 for the template %2 was not performed because this template has been superseded.

Fields

Message

SCEP Certificate enrollment for %1 via %2 succeeded:

%3
Method: %4
Stage: %5

Fields

Message

Successfully found Logon Certificate Template for %1
Template: %2
State: %3
Process: %4

Fields

Message

Logon Certificate Request creation for %1 succeeded for the %2 template for key %3
Request thumbprint: %4
Process: %5

Fields

Message

Successfully installed Logon Certificate for %1
Request thumbprint: %2
Thumbprint: %3
Process: %4

Fields

Message

Certificate enrollment for %1 could not find a certification authority in the enterprise.  Enrollment was not performed.

Fields

Message

Certificate enrollment for {Context} encountered errors while retrieving information about the certification authority from Active Directory ({ErrorCode}). Enrollment was not performed.

Fields

Message

Certificate enrollment for %1 failed to retrieve certificate template information from the Policy Server. Enrollment was not performed.

Fields

Message

Certificate enrollment for %1 failed to enroll for a %2 certificate from certification authority %3 (%4). Another certification authority will be contacted.

Fields

Message

Certificate enrollment for %1 failed to renew a %2 certificate from certification authority %3 (%4). Another certification authority will be contacted.

Fields

Message

Certificate enrollment for {Context} cannot enroll or renew {TemplateName} certificate because the certificate template is used for smart cards and the cryptographic service provider (CSP) list is empty.

Fields

Message

Certificate enrollment for {Context} cannot enroll or renew {TemplateName} certificate because strong private key protection is required on the new private key that will be generated and computer certificates do not support strong private key protection.

Fields

Message

Certificate enrollment for %1 cannot enroll or renew %2 certificate because user interaction is required on the %2 template in Active Directory.

Fields

Message

Certificate enrollment for {Context} cannot enroll or renew {TemplateName} certificate because a password is required to access the associated private key of a valid signing certificate and computer certificates do not support strong private key protection.

Fields

Message

Certificate enrollment for {Context} cannot enroll or renew {TemplateName} certificate because a password is required to access the associated private key of a valid signing certificate and the user interaction requirement is not enabled on the {TemplateName} template in Active Directory.

Fields

Message

Certificate enrollment for %1 for the %2 template must be performed by using the machine context.

Fields

Message

Certificate enrollment for %1 failed to find a smart card reader for the %2 template.  Enrollment will not be performed.

Fields

Message

Certificate enrollment for %1 failed to open the user interface (%2).

Fields

Message

Certificate enrollment for %1 could not enroll for a %2 certificate.  Read or enrollment access is not allowed for this template.

Fields

Message

Certificate enrollment for %1 could not enroll for a %2 certificate.  A valid certification authority cannot be found to issue this template.

Fields

Message

Certificate enrollment for %1 could not enroll for a %2 certificate.  Signature requirements for the certificate cannot be met.

Fields

Message

Certificate enrollment for %1 failed to install the certificate response for a %2 certificate with request ID %3 (%4).

Fields

Message

Certificate enrollment for %1 for the %2 certificate must be performed under the user context.

Fields

Message

The CA certificate for %3 is not trusted. Certificate enrollment for %1 for a %2 certificate failed.

Fields

Message

Certificate enrollment for %1 failed to retrieve a %2 certificate from certification authority %3 with request ID %4, and the error returned from the server is %5.  Another certification authority will be contacted.

Fields

Message

Certificate enrollment for %1 failed to retrieve a pending %2 certificate with request ID %4 from certification authority %3 (%5). The enrollment process will be attempted again later.

Fields

Message

Certificate enrollment for %1 for the %2 template could not find specified CSPs on the local machine.  Enrollment will not be performed.

Fields

Message

The "%2" provider was not loaded because initialization failed.

Fields

Message

The "%3" algorithm for the "%2" provider was not loaded because initialization failed.

Fields

Message

Could not determine the signature algorithm for %2 to sign an enrollment request.

Fields

Message

Could not find a registered public key algorithm OID for %2 for an enrollment request.

Fields

Message

Could not find a registered signature algorithm OID for %1 and %2 to sign an enrollment request.

Fields

Message

Could not encode signature parameters for a %2 signature for an enrollment request.

Fields

Message

Enrollment Policy Server %2 returned an error when retrieving templates for %1: %3

Fields

Message

Certificate enrollment for %1 successfully load policy from policy server %2

Fields

Message

Certificate enrollment for %1 is successfully authenticated by policy server %2 using authentication mechanism %5 (Credential: %4). Policy Id: %3

Fields

Message

Certificate enrollment for %1 is successfully authenticated by enrollment server %2 using authentication mechanism %5 (Credential: %4). Policy Id: %3

Fields

Message

Certificate enrollment for %1 failed to load policy from policy servers with ID  %2 (%3)

Fields

Message

Certificate enrollment for %1 failed in authentication to policy servers with ID %2  (%3)

Fields

Message

Certificate enrollment for %1 failed because no valid policy can be obtained from policy servers with ID %2

Fields

Message

Certificate enrollment for %1 failed in adding credential to Vault for %2 (%3)

Fields

Message

Certificate enrollment for %1 failed because the loaded policy from the policy server %2 is invalid (%3)

Fields

Message

Certificate auto enrollment for %1 cannot be done because the policy server %2 turns it off.

Fields

Message

Certificate enrollment for %1 failed to load policy from policy server %2 with ID  %3 (%4)

Fields

Message

Certificate enrollment for %1 failed in authentication to policy server %2 with ID  %3 (%6). Authentication mechanism was %5 (Credential: %4)

Fields

Message

Certificate enrollment for %1 failed in authentication to enrollment server %2 (%6). Policy Id: %3. Authentication mechanism was %5 (Credential: %4)

Fields

Message

Certificate enrollment for %1 cannot enroll from user configured enrollment policy server since it is disabled by group policy

Fields

Message

Certificate enrollment for %1 sent a request for template %2 to a ROBO certificate enrollment server %3

Fields

Message

Certificate enrollment for %1 sent a request for template %2 to a ANONYMOUS certificate enrollment server %3

Fields

Message

Certificate enrollment for %1 cannot enroll for a %2 certificate because the certificate enrollment server %3 is ROBO and only renewal is supported

Fields

Message

Certificate enrollment for %1 cannot enroll for a %2 certificate because the certificate enrollment server %3 is ANONYMOUS and only renewal is supported

Fields

Message

Certificate enrollment for %1 failed in authentication to all urls for enrollment server associated with policy id: %2 (%4). Failed to enroll for template: %3

Fields

Message

Certificate enrollment for %1 cannot find a credential that meets the selection criteria for url %2 with id %3 (%4)

Fields

Message

The credential for URL %2 has been updated from certificate (%4) to certificate (%3) in context %1

Fields

Message

Certificate enrollment for %1 for the %2 template could not perform attestation due to an error with the cryptographic hardware using the provider: %3. Request Id: %4.%5

Fields

Message

Successfully removed Logon Certificate request for %1
Request thumbprint: %2
Process: %3

Fields

Message

Certificate enrollment for %1 could not find a valid certificate template to match %2.  Enrollment was not performed.

Fields

Message

Certificate enrollment for %1 was denied by %3 when retrieving the pending request for a %2 certificate with request ID %4.

Fields

Message

Certificate enrollment for %1 failed to enroll for a %2 certificate with request ID %4 from %3 (%5).

Fields

Message

Certificate enrollment for %1 failed to renew a %2 certificate with request ID %4 from %3 (%6). The certificate which failed to renew is %5

Fields

Message

Certificate enrollment for {Context} failed to renew a {TemplateName} certificate because it cannot find a certification authority to issue the certificate template.

Fields

Message

Certificate enrollment for {Context} failed to enroll for a {TemplateName} certificate because it cannot find a certification authority to issue the certificate.

Fields

Message

Certificate enrollment for {Context} failed to show the user notification balloon ({ErrorCode}).

Fields

Message

Certificate enrollment for {Context} failed to install a {TemplateName} certificate when retrieving pending requests ({ErrorCode}).

Fields

Message

Certificate enrollment for %1 detected that the DNS name in the %2 certificate does not match the DNS name of the local computer.  A new enrollment for a %2 certificate will be attempted in %3 hours.

Fields

Message

Certificate enrollment for %1 detected that the DNS name in the %2 certificate does not match the DNS name of the local computer.  No more enrollments for %2 certificates will be attempted until the current certificate is revoked or expires because the same error has occurred %3 times.

Fields

Message

Certificate enrollment for %1 failed to create an enrollment request for a %2 certificate (%3).

Fields

Message

SCEP Certificate enrollment initialization for %1 via %2 failed:

%3
Method: %4
Stage: %5
%6

Fields

Message

SCEP Certificate enrollment for %1 via %2 failed:

%3
Method: %4
Stage: %5
%6

Fields

Message

Could not find a Logon Certificate Template for %1
Template: %2
State: %3
Process: %4
%5

Fields

Message

Found multiple Logon Certificate Templates for %1
Templates: %2
State: %3
Process: %4
%5

Fields

Message

Logon Certificate Request creation for %1 failed for the %2 template for key %3
%4
Process: %5
%6

Fields

Message

Failed to install Logon Certificate for %1 failed
Request thumbprint: %2
Thumbprint: %3
%4
Process: %5
%6

Fields

Message

Failed to remove Logon Certificate request for %1
Request thumbprint: %2
Process: %3
%4

Fields

Message

Failed to import PFX Certificate for %1
Flags: %2
Provider: %3
Container: %4
Process: %5
%6

Fields