Microsoft-Windows-CertPolEng

48 events across 1 channel

Event IDTitleChannel
0Entering Function FunctionName.Operational
1Exiting Function FunctionName.Operational
2FunctionName failed with return code LastError.Operational
3FunctionName returned LastError.Operational
4Not running inside LSAOperational
5Running inside LSAOperational
6Cert Store changes are detectedOperational
7No online providers are installedOperational
8There are no trust anchors for the providersOperational
9Total number of TrustRoot Found Number.Operational
10Target name is TargetName, HostName is HostName.Operational
11PSTGetCertificate called, number of select criteria are NumOfCriteria, bIsClient …Operational
12Opening Machine Store?Operational
13Expired cert foundOperational
14Unable to find Provider From Certificate: Error LastError.Operational
15Calling LRPC cert renewal Interface psz.Operational
16Expired Certificate were found, will call CertSelectCertificateChains againOperational
17No matching Certificate were foundOperational
18Will Special case for Homegroup self sign certificatesOperational
19GetCertificates returning Number certificates.Operational
20RequestIssuancePolicy Is SpecifiedOperational
21Certificate is Self SignedOperational
22Certificate found in HomeGroup ContainerOperational
23Checking if the Certificate is from one of the ProvidersOperational
24Cert Subject name is psz.Operational
25UserName is psz.Operational
26Failed to Connect to psz.Operational
27CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider …Operational
28Failed to Open Provider Root Key Number.Operational
29Failed to Query Provider Root Key Number.Operational
30Failed to Query SubKey SubKey, Error LastError.Operational
31Invalid Provider GUID SubKey.Operational
32CertVerifyCertificateChainPolicy Failed Status is LastError, ChainIndex …Operational
33Failed to open LSA Registry Root Key Number.Operational
34Pku2u is disabled by policyOperational
35Failed to open StoreName certificate store.Operational
36Failed to validate certificate.Operational
37Failed to validate certificate.Operational
38UPN and client RDN are missingOperational
39The client name doesn't match the UPN.Operational
40The client name is psz.Operational
41The client name matched the UPN.Operational
42Certificate validation succeeded as the hash comparison succeededOperational
43Unable to find the certificate in the HomeGroup ContainerOperational
44The certificate chains to an untrusted rootOperational
45The supplied or saved credman credential with username UserName is not a UPN.Operational
46Provider Provider is not enabled.Operational
47Failed for Certificate …Operational

Event ID 0 — Entering Function FunctionName.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Informational
Opcode
Info

Description

Entering Function FunctionName.

Message #

Entering Function %1

Fields #

NameDescription
FunctionName AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524244+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "IntPstGetTrustAnchors"
  },
  "message": ""
}

Event ID 1 — Exiting Function FunctionName.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Informational
Opcode
Info

Description

Exiting Function FunctionName.

Message #

Exiting Function %1

Fields #

NameDescription
FunctionName AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524262+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "CProviderRegistrationCache::IntGetTrustAnchors"
  },
  "message": ""
}

Event ID 2 — FunctionName failed with return code LastError.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Error
Opcode
Info

Description

FunctionName failed with return code LastError.

Message #

%1 failed with return code %2

Fields #

NameDescription
FunctionName AnsiString
LastError UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524258+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "IntGetTrustAnchors(actual error)",
    "LastError": 3221685484
  },
  "message": ""
}

Event ID 3 — FunctionName returned LastError.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Message #

%1 returned %2

Fields #

NameDescription
FunctionName AnsiString
LastError UInt32

Event ID 4 — Not running inside LSA

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Not running inside LSA.

Message #

Not running inside LSA

Event ID 5 — Running inside LSA

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Informational
Opcode
Info

Description

Running inside LSA.

Message #

Running inside LSA

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-14T16:28:40.910557+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "0DD0D01B-52DE-45C4-BB8D-BF1723FA1D6F"
    },
    "execution": {
      "process_id": 1092,
      "thread_id": 3352
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 6 — Cert Store changes are detected

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Cert Store changes are detected.

Message #

Cert Store changes are detected

Event ID 7 — No online providers are installed

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

No online providers are installed.

Message #

No online providers are installed

Event ID 8 — There are no trust anchors for the providers

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

There are no trust anchors for the providers.

Message #

There are no trust anchors for the providers

Event ID 9 — Total number of TrustRoot Found Number.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Total number of TrustRoot Found Number.

Message #

Total number of TrustRoot Found %1

Fields #

NameDescription
Number UInt32

Event ID 10 — Target name is TargetName, HostName is HostName.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Target name is TargetName, HostName is HostName.

Message #

Target name is %1, HostName is %2

Fields #

NameDescription
TargetName UnicodeString
HostName UnicodeString

Event ID 11 — PSTGetCertificate called, number of select criteria are NumOfCriteria, bIsClient parameter is bClient.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

PSTGetCertificate called, number of select criteria are NumOfCriteria, bIsClient parameter is bClient.

Message #

PSTGetCertificate called, number of select criteria are %1, bIsClient parameter is %2

Fields #

NameDescription
NumOfCriteria UInt32
bClient Boolean

Event ID 12 — Opening Machine Store?

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Opening Machine Store? Value: Opening_Machine_Store_Value.

Message #

Opening Machine Store? Value: %1

Fields #

NameDescription
Opening_Machine_Store_Value UInt32Opening Machine Store? Value.
Number UInt32

Event ID 13 — Expired cert found

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Expired cert found.

Message #

Expired cert found

Event ID 14 — Unable to find Provider From Certificate: Error LastError.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Unable to find Provider From Certificate: Error LastError.

Message #

Unable to find Provider From Certificate: Error %1

Fields #

NameDescription
LastError UInt32

Event ID 15 — Calling LRPC cert renewal Interface psz.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Calling LRPC cert renewal Interface psz.

Message #

Calling LRPC cert renewal Interface %1

Fields #

NameDescription
psz UnicodeString

Event ID 16 — Expired Certificate were found, will call CertSelectCertificateChains again

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Expired Certificate were found, will call CertSelectCertificateChains again.

Message #

Expired Certificate were found, will call CertSelectCertificateChains again

Event ID 17 — No matching Certificate were found

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

No matching Certificate were found.

Message #

No matching Certificate were found

Event ID 18 — Will Special case for Homegroup self sign certificates

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Will Special case for Homegroup self sign certificates.

Message #

Will Special case for Homegroup self sign certificates

Event ID 19 — GetCertificates returning Number certificates.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

GetCertificates returning Number certificates.

Message #

GetCertificates returning %1 certificates

Fields #

NameDescription
Number UInt32

Event ID 20 — RequestIssuancePolicy Is Specified

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

RequestIssuancePolicy Is Specified.

Message #

RequestIssuancePolicy Is Specified

Event ID 21 — Certificate is Self Signed

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Certificate is Self Signed.

Message #

Certificate is Self Signed

Event ID 22 — Certificate found in HomeGroup Container

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Certificate found in HomeGroup Container.

Message #

Certificate found in HomeGroup Container

Event ID 23 — Checking if the Certificate is from one of the Providers

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Checking if the Certificate is from one of the Providers.

Message #

Checking if the Certificate is from one of the Providers

Event ID 24 — Cert Subject name is psz.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Cert Subject name is psz.

Message #

Cert Subject name is %1

Fields #

NameDescription
psz UnicodeString

Event ID 25 — UserName is psz.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

UserName is psz.

Message #

UserName is %1

Fields #

NameDescription
psz UnicodeString

Event ID 26 — Failed to Connect to psz.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to Connect to psz.

Message #

Failed to Connect to %1

Fields #

NameDescription
psz UnicodeString

Event ID 27 — CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider Provider.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider Provider. Error code LastError.

Message #

CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider %1. Error code %2

Fields #

NameDescription
Provider GUID
LastError UInt32

Event ID 28 — Failed to Open Provider Root Key Number.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to Open Provider Root Key Number.

Message #

Failed to Open Provider Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 29 — Failed to Query Provider Root Key Number.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to Query Provider Root Key Number.

Message #

Failed to Query Provider Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 30 — Failed to Query SubKey SubKey, Error LastError.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to Query SubKey SubKey, Error LastError.

Message #

Failed to Query SubKey %1, Error %2

Fields #

NameDescription
SubKey UInt32
LastError UInt32

Event ID 31 — Invalid Provider GUID SubKey.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Invalid Provider GUID SubKey. LastError.

Message #

Invalid Provider GUID %1. %2

Fields #

NameDescription
SubKey UnicodeString
LastError UInt32

Event ID 32 — CertVerifyCertificateChainPolicy Failed Status is LastError, ChainIndex ChainIndex, lElementIndex lElementIndex.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

CertVerifyCertificateChainPolicy Failed Status is LastError, ChainIndex ChainIndex, lElementIndex lElementIndex.

Message #

CertVerifyCertificateChainPolicy Failed Status is %1, ChainIndex %2, lElementIndex %3

Fields #

NameDescription
LastError UInt32
ChainIndex UInt32
lElementIndex UInt32

Event ID 33 — Failed to open LSA Registry Root Key Number.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to open LSA Registry Root Key Number.

Message #

Failed to open LSA Registry Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 34 — Pku2u is disabled by policy

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Informational
Opcode
Info

Description

Pku2u is disabled by policy.

Message #

Pku2u is disabled by policy

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524248+00:00",
    "event_record_id": 3,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 35 — Failed to open StoreName certificate store.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to open StoreName certificate store. Error LastError.

Message #

Failed to open %1 certificate store. Error %2

Fields #

NameDescription
StoreName UnicodeString
LastError UInt32

Event ID 36 — Failed to validate certificate.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to validate certificate. Hash length doesn't match. Source hash Length Source, calculated hash length Calculated.

Message #

Failed to validate certificate. Hash length doesn't match. Source hash Length %1, calculated hash length %2

Fields #

NameDescription
Source UInt32
Calculated UInt32

Event ID 37 — Failed to validate certificate.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Failed to validate certificate. The hash comparison failed.

Message #

Failed to validate certificate. The hash comparison failed

Event ID 38 — UPN and client RDN are missing

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

UPN and client RDN are missing.

Message #

UPN and client RDN are missing

Event ID 39 — The client name doesn't match the UPN.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

The client name doesn't match the UPN. UPN is UPN, client name is ClientName.

Message #

The client name doesn't match the UPN. UPN is %1, client name is %2

Fields #

NameDescription
UPN UnicodeString
ClientName UnicodeString

Event ID 40 — The client name is psz.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

The client name is psz.

Message #

The client name is %1

Fields #

NameDescription
psz UnicodeString

Event ID 41 — The client name matched the UPN.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

The client name matched the UPN. UPN is UPN, client name is ClientName.

Message #

The client name matched the UPN. UPN is %1, client name is %2

Fields #

NameDescription
UPN UnicodeString
ClientName UnicodeString

Event ID 42 — Certificate validation succeeded as the hash comparison succeeded

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Certificate validation succeeded as the hash comparison succeeded.

Message #

Certificate validation succeeded as the hash comparison succeeded

Event ID 43 — Unable to find the certificate in the HomeGroup Container

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

Unable to find the certificate in the HomeGroup Container.

Message #

Unable to find the certificate in the HomeGroup Container

Event ID 44 — The certificate chains to an untrusted root

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

The certificate chains to an untrusted root.

Message #

The certificate chains to an untrusted root

Event ID 45 — The supplied or saved credman credential with username UserName is not a UPN.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Opcode
Info

Description

The supplied or saved credman credential with username UserName is not a UPN.

Message #

The supplied or saved credman credential with username %1 is not a UPN.

Fields #

NameDescription
UserName UnicodeString

Event ID 46 — Provider Provider is not enabled.

Provider
Microsoft-Windows-CertPolEng
Channel
Operational
Level
Error
Opcode
Info

Description

Provider Provider is not enabled.

Message #

%1 Provider is not enabled.

Fields #

NameDescription
Provider GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 46,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-14T16:28:40.869270+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "0DD0D01B-52DE-45C4-BB8D-BF1723FA1D6F"
    },
    "execution": {
      "process_id": 1092,
      "thread_id": 3352
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Provider": "6D0F37E4-4FAC-4E44-9C07-6B8343FE4953"
  },
  "message": ""
}

Event ID 47 — Failed for Certificate (encoding=EncodingType,length=EncodedCertLength,value=EncodedCert).

Provider
Microsoft-Windows-CertPolEng
Channel
Operational

Description

Failed for Certificate (encoding=EncodingType,length=EncodedCertLength,value=EncodedCert).

Message #

Failed for Certificate (encoding=%1,length=%2,value=%3).

Fields #

NameDescription
EncodingType UInt32
EncodedCertLength UInt32
EncodedCert Binary