Microsoft-Windows-CertificateServicesClient

10 events across 1 channel

Event	Title	Channel
1	Certificate Services Client has been started successfully.	Application
2	Certificate Services Client has been stopped.	Application
3	Certificate Services Client has detected network connectivity.	Application
4	Certificate Services Client has detected network dis-connectivity.	Application
501	Certificate Services Client is triggered with bad parameters: Parameter.	Application
502	Certificate Services Client failed to register Group Policy notifications.	Application
1001	Certificate Services Client failed to load Provider ProviderName.	Application
1002	Certificate Services Client cannot find the required interface in Provider …	Application
1003	Certificate Services Client failed to invoke the Providers in response to event …	Application
1004	Certificate Services Client Provider ProviderName raised an exception.	Application

Event ID 1: Certificate Services Client has been started successfully.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client has been started successfully.

Message #

Certificate Services Client has been started successfully.

Event ID 2: Certificate Services Client has been stopped.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client has been stopped.

Message #

Certificate Services Client has been stopped.

Event ID 3: Certificate Services Client has detected network connectivity.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client has detected network connectivity.

Message #

Certificate Services Client has detected network connectivity.

Event ID 4: Certificate Services Client has detected network dis-connectivity.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client has detected network dis-connectivity.

Message #

Certificate Services Client has detected network dis-connectivity.

Event ID 501: Certificate Services Client is triggered with bad parameters: Parameter.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client is triggered with bad parameters: Parameter.

Message #

Certificate Services Client is triggered with bad parameters: %1.

Fields #

Name	Description
`Parameter` UnicodeString

Event ID 502: Certificate Services Client failed to register Group Policy notifications.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client failed to register Group Policy notifications. Error code: ErrorCode.

Message #

Certificate Services Client failed to register Group Policy notifications. Error code: %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1001: Certificate Services Client failed to load Provider ProviderName.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client failed to load Provider ProviderName. Error code ErrorCode.

Message #

Certificate Services Client failed to load Provider %1. Error code %2.

Fields #

Name	Description
`ProviderName` UnicodeString
`ErrorCode` UInt32

Event ID 1002: Certificate Services Client cannot find the required interface in Provider ProviderName.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client cannot find the required interface in Provider ProviderName. Error code ErrorCode.

Message #

Certificate Services Client cannot find the required interface in Provider %1. Error code %2.

Fields #

Name	Description
`ProviderName` UnicodeString
`ErrorCode` UInt32

Event ID 1003: Certificate Services Client failed to invoke the Providers in response to event Flags.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client failed to invoke the Providers in response to event Flags. Error code ErrorCode.

Message #

Certificate Services Client  failed to invoke the Providers in response to event %1. Error code %2.

Fields #

Name	Description
`Flags` UInt32
`ErrorCode` UInt32

Event ID 1004: Certificate Services Client Provider ProviderName raised an exception.

Provider: Microsoft-Windows-CertificateServicesClient
Channel: Application

Description

Certificate Services Client Provider ProviderName raised an exception. Exception code ErrorCode.

Message #

Certificate Services Client Provider %1 raised an exception. Exception code %2.

Fields #

Name	Description
`ProviderName` UnicodeString
`ErrorCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 73370bd6-85e5-430b-b60a-fea1285808a7

Defined in dimsjob.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)