Event ID 1006 — A new certificate has been installed.
Description
A new certificate has been installed. Please refer to the "Details" section for more information.
Message #
Fields #
| Name | Description |
|---|---|
CertNotificationData.ProcessName | — |
CertNotificationData.AccountName | — |
CertNotificationData.Context | — |
CertNotificationData.Action | — |
CertNotificationData.CertificateDetails | — |
EventWriteData UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CertificateServicesClient-Lifecycle-System",
"guid": "{bc0669e1-a10d-4a78-834e-1ca3c806c93b}",
"event_source_name": "",
"event_id": 1006,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:17:39.800243+00:00",
"event_record_id": 2,
"correlation": {},
"execution": {
"process_id": 4972,
"thread_id": 4200
},
"channel": "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CertNotificationData": {
"ProcessName": "taskhostw.exe",
"AccountName": "ludus\\LAB-DC01$",
"Context": "Machine",
"Action": "Enroll",
"CertificateDetails": {
"Thumbprint": "db0fea9b641f3814fc5168ae83ef7839af1bb012",
"Template": {
"Name": "DomainController"
},
"SubjectNames": {
"SubjectName": "CN=LAB-DC01.ludus.domain",
"SubjectName_1": "997a085b-5e01-4f75-9c22-ed3af23d348a",
"SubjectName_2": "LAB-DC01.ludus.domain"
},
"EKUs": {
"EKU": {
"Name": "Client Authentication",
"OID": "1.3.6.1.5.5.7.3.2"
},
"EKU_1": {
"Name": "Server Authentication",
"OID": "1.3.6.1.5.5.7.3.1"
}
},
"NotValidAfter": "2027-03-13T20:07:39Z"
}
}
},
"message": ""
}