Event ID 1001 — A certificate has been replaced.
Description
A certificate has been replaced. Please refer to the "Details" section for more information.
Message #
Fields #
| Name | Description |
|---|---|
CertNotificationData.ProcessName | — |
CertNotificationData.AccountName | — |
CertNotificationData.Context | — |
CertNotificationData.Action | — |
CertNotificationData.OldCertificateDetails | — |
CertNotificationData.NewCertificateDetails | — |
EventWriteData UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CertificateServicesClient-Lifecycle-System",
"guid": "{bc0669e1-a10d-4a78-834e-1ca3c806c93b}",
"event_source_name": "",
"event_id": 1001,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T23:08:39.437859+00:00",
"event_record_id": 8,
"correlation": {},
"execution": {
"process_id": 7080,
"thread_id": 1724
},
"channel": "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CertNotificationData": {
"ProcessName": "taskhostw.exe",
"AccountName": "ludus\\LAB-DC01$",
"Context": "Machine",
"Action": "Renew",
"OldCertificateDetails": {
"Thumbprint": "db0fea9b641f3814fc5168ae83ef7839af1bb012",
"Template": {
"Name": "DomainController"
},
"SubjectNames": {
"SubjectName": "CN=LAB-DC01.ludus.domain",
"SubjectName_1": "997a085b-5e01-4f75-9c22-ed3af23d348a",
"SubjectName_2": "LAB-DC01.ludus.domain"
},
"EKUs": {
"EKU": {
"Name": "Client Authentication",
"OID": "1.3.6.1.5.5.7.3.2"
},
"EKU_1": {
"Name": "Server Authentication",
"OID": "1.3.6.1.5.5.7.3.1"
}
},
"NotValidAfter": "2027-03-13T20:07:39Z"
},
"NewCertificateDetails": {
"Thumbprint": "1a202ed21d19f873e0a448f967dfe428f278fccd",
"Template": {
"Name": "DomainController"
},
"SubjectNames": {
"SubjectName": "CN=LAB-DC01.ludus.domain",
"SubjectName_1": "997a085b-5e01-4f75-9c22-ed3af23d348a",
"SubjectName_2": "LAB-DC01.ludus.domain"
},
"EKUs": {
"EKU": {
"Name": "Client Authentication",
"OID": "1.3.6.1.5.5.7.3.2"
},
"EKU_1": {
"Name": "Server Authentication",
"OID": "1.3.6.1.5.5.7.3.1"
}
},
"NotValidAfter": "2027-03-13T22:58:39Z"
}
}
},
"message": ""
}