detection.wiki

Microsoft-Windows-Crypto-NCrypt

26 events across 3 channels

Event IDTitleChannel
1Cryptographic Operation failed.Operational
2Open Provider operation failed.Operational
3Open Key operation failed.Operational
4Create Key operation failed.Operational
5Protect Key operation failed.Operational
6Unprotect Key operation failed.Operational
7Protect Secret operation failed.Operational
8Unprotect Secret operation failed.Operational
9Key write succeeded.Operational
10Key write failed.Operational
11Delete key succeeded.Operational
12Delete key failed.Operational
13VBS Key Isolation operation failed.Operational
14VBS Key Isolation operation failed.Operational
15New client uses VBS Key Isolation.Operational
16Cert-In-Use Message.CertInUse
17Cert-In-Use Failed.CertInUse
18Key Guard attestation operation failed.Operational
19Key Guard attestation operation failed.Operational
20VBS Key Isolation is not available.Operational
21Key write succeeded.KeyMgmt
22Delete key succeeded.KeyMgmt
23Capi1 Container write succeeded.KeyMgmt
24Capi1 Container Delete succeeded.KeyMgmt
25VBS Key Isolation status: Status.Operational
26VBS Key Protection restart attempted.Operational

Event ID 1 — Cryptographic Operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Error
Task
OperationFailure

Description

Cryptographic Operation failed.

Message #

Cryptographic Operation failed.

 Cryptographic Parameters:
 	OperationType: %1
 	Provider Name: %2
 	Key Name: %3
 	Key Type: %4
 	Algorithm Name: %5
 
Failure Information:
 	Return Code: %6

Fields #

NameDescription
OperationType UInt32[Cryptographic Parameters] OperationType.
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time
ProviderName UnicodeString—
KeyName UnicodeString—
KeyType UnicodeString—
Known values
%%2499
Machine key
%%2500
User key
AlgorithmName UnicodeString—
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString—
Provider_Name[Cryptographic Parameters] Provider Name.
Key_Name[Cryptographic Parameters] Key Name.
Key_Type[Cryptographic Parameters] Key Type.
Algorithm_Name[Cryptographic Parameters] Algorithm Name.
Return_Code[Failure Information] Return Code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2025-12-31T19:35:46.563871+00:00",
    "event_record_id": 23,
    "correlation": {
      "ActivityID": "8D2E1BCA-7A8C-0001-8674-2E8D8C7ADC01"
    },
    "execution": {
      "process_id": 5364,
      "thread_id": 6168
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "OperationType": 17,
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "NULL",
    "KeyType": "",
    "AlgorithmName": "",
    "Status": "0x80090029",
    "ProcessName": "powershell.exe"
  },
  "message": ""
}

Event ID 2 — Open Provider operation failed.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Error
Task
OpenProviderFailure

Description

Open Provider operation failed.

Message #

Open Provider operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 Failure Information:
 	Return Code: %3

Fields #

NameDescription
ProviderName UnicodeString[Cryptographic Parameters] Provider Name.
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString[Failure Information] Return Code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T06:25:39.826665+00:00",
    "event_record_id": 24,
    "correlation": {
      "ActivityID": "F590C418-1079-0001-5BC5-90F57910DA01"
    },
    "execution": {
      "process_id": 808,
      "thread_id": 856
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Platform Crypto Provider",
    "Status": "0x80090030",
    "ProcessName": "lsass.exe"
  },
  "message": ""
}

References #

Event ID 3 — Open Key operation failed.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Error
Task
OpenKeyFailure

Description

Open Key operation failed.

Message #

Open Key operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 	Key Name: %2
 Failure Information:
 	Return Code: %3

Fields #

NameDescription
ProviderName UnicodeString[Cryptographic Parameters] Provider Name.
KeyName UnicodeString[Cryptographic Parameters] Key Name.
Status HexInt32[Failure Information] Return Code. NTSTATUS reference
ProcessName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-05T22:28:56.226219+00:00",
    "event_record_id": 30,
    "correlation": {},
    "execution": {
      "process_id": 5416,
      "thread_id": 5476
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "Microsoft Connected Devices Platform device certificate",
    "Status": "0x80090016",
    "ProcessName": "svchost.exe"
  },
  "message": ""
}

References #

Event ID 4 — Create Key operation failed.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Error
Task
KeyCreationFailure

Description

Create Key operation failed.

Message #

Create Key operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 	Key Name: %2
 	Algorithm Name: %3
 	Flags: %4
 Failure Information:
  	Return Code: %5

Fields #

NameDescription
ProviderName UnicodeString[Cryptographic Parameters] Provider Name.
KeyName UnicodeString[Cryptographic Parameters] Key Name.
AlgorithmName UnicodeString[Cryptographic Parameters] Algorithm Name.
Flags HexInt32[Cryptographic Parameters] Flags.
Status HexInt32[Failure Information] Return Code. NTSTATUS reference
ProcessName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 2,
    "task": 4,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T01:47:51.933305+00:00",
    "event_record_id": 47,
    "correlation": {},
    "execution": {
      "process_id": 13296,
      "thread_id": 8852
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "ChromeMetricsTestKey",
    "AlgorithmName": "ECDSA_P256",
    "Flags": "0x20000",
    "Status": "0x80090029",
    "ProcessName": "chrome.exe"
  },
  "message": ""
}

References #

Event ID 5 — Protect Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
OperationFailure_5

Description

Protect Key operation failed.

Message #

Protect Key operation failed.

 Cryptographic Parameters:
 	Protector Name: %1
 	Protector Attributes:
			%2
 	Flags: %3
 Failure Information:
 	Return Code: %4

Fields #

NameDescription
Protector_Name[Cryptographic Parameters] Protector Name.
Protector_Attributes—
Flags HexInt32[Protector Attributes] Flags.
Return_Code[Failure Information] Return Code.
ProtectorName UnicodeString—
ProtectorAttributes UnicodeString—
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString—

Event ID 6 — Unprotect Key operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
OperationFailure_6

Description

Unprotect Key operation failed.

Message #

Unprotect Key operation failed.

 Cryptographic Parameters:
 	Protector Name: %1
 	Recipient Type: %2
 	Flags: %3
 Failure Information:
 	Return Code: %4

Fields #

NameDescription
Protector_Name[Cryptographic Parameters] Protector Name.
Recipient_Type[Cryptographic Parameters] Recipient Type.
Flags HexInt32[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
ProtectorName UnicodeString—
RecipientType UInt32—
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString—
KeyIdLength UInt32—
KeyId Binary—

Event ID 7 — Protect Secret operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
OperationFailure_7

Description

Protect Secret operation failed.

Message #

Protect Secret operation failed.

 Cryptographic Parameters:
 	Flags: %1
 Failure Information:
 	Return Code: %2

Fields #

NameDescription
Flags HexInt32[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString—

Event ID 8 — Unprotect Secret operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
OperationFailure_8

Description

Unprotect Secret operation failed.

Message #

Unprotect Secret operation failed.

 Cryptographic Parameters:
 	Flags: %1
 Failure Information:
 	Return Code: %2

Fields #

NameDescription
Flags HexInt32[Cryptographic Parameters] Flags.
Return_Code[Failure Information] Return Code.
Status HexInt32— NTSTATUS reference
ProcessName UnicodeString—

Event ID 9 — Key write succeeded.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Verbose
Task
Keywritesucceeded

Description

Key write succeeded.

Message #

Key write succeeded.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
ProviderName UnicodeString—
KeyModificationType HexInt32ModificationType.
Flags HexInt32—
KeyName UnicodeString—
KeyFileName UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ThreadId HexInt32ServerThreadId.
UserId UnicodeString—
ServiceTag UnicodeString—
Status HexInt32Return Code. NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 5,
    "task": 9,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-05T22:28:56.259521+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 808,
      "thread_id": 856
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyModificationType": "0x1",
    "Flags": "0x0",
    "KeyName": "Microsoft Connected Devices Platform device certificate",
    "KeyFileName": "de7cf8a7901d2ad13e5c67c29e5d1662_e56ada26-b69d-4d96-86fb-2b434b08d2d0",
    "ProcessName": "C:\\Windows\\System32\\svchost.exe",
    "ProcessId": "0x1528",
    "ThreadId": "0x358",
    "UserId": "S-1-5-19",
    "ServiceTag": "CDPSvc",
    "Status": "0x0"
  },
  "message": ""
}

References #

Event ID 10 — Key write failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
Keywritefailed

Description

Key write failed.

Message #

Key write failed.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
Provider_Name UnicodeString—
ModificationType HexInt32—
Flags HexInt32—
Key_Name UnicodeString—
Key_File_Name UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ServerThreadId HexInt32—
UserId UnicodeString—
ServiceTag UnicodeString—
Return_Code HexInt32—
ProviderName UnicodeString—
KeyModificationType HexInt32—
KeyName UnicodeString—
KeyFileName UnicodeString—
ThreadId HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 11 — Delete key succeeded.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Verbose
Task
Deletekeysucceeded

Description

Delete key succeeded.

Message #

Delete key succeeded.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
ProviderName UnicodeString—
Flags HexInt32—
DeletionType HexInt32—
KeyName UnicodeString—
KeyFileName UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ThreadId HexInt32ServerThreadId.
UserId UnicodeString—
ServiceTag UnicodeString—
Status HexInt32Return Code. NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 5,
    "task": 11,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-05T22:28:56.224021+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 808,
      "thread_id": 856
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "Flags": "0x40",
    "DeletionType": "0x0",
    "KeyName": "Microsoft Connected Devices Platform device certificate",
    "KeyFileName": "de7cf8a7901d2ad13e5c67c29e5d1662_31383106-803d-411b-9763-a28cdc0f0c3f",
    "ProcessName": "C:\\Windows\\System32\\svchost.exe",
    "ProcessId": "0x1528",
    "ThreadId": "0x358",
    "UserId": "S-1-5-19",
    "ServiceTag": "CDPSvc",
    "Status": "0x0"
  },
  "message": ""
}

References #

Event ID 12 — Delete key failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
Deletekeyfailed

Description

Delete key failed.

Message #

Delete key failed.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
Provider_Name UnicodeString—
Flags HexInt32—
DeletionType HexInt32—
Key_Name UnicodeString—
Key_File_Name UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ServerThreadId HexInt32—
UserId UnicodeString—
ServiceTag UnicodeString—
Return_Code HexInt32—
ProviderName UnicodeString—
KeyName UnicodeString—
KeyFileName UnicodeString—
ThreadId HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 13 — VBS Key Isolation operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

VBS Key Isolation operation failed.

Message #

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields #

NameDescription
Function AnsiString—
Info UnicodeString—
Status— NTSTATUS reference
StatusCode HexInt32—
StatusString HexInt32—

Event ID 14 — VBS Key Isolation operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

VBS Key Isolation operation failed.

Message #

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Client: %5
Client %1 failures: %6
Global %1 failures: %7
Global %1 successes: %8

Fields #

NameDescription
Function AnsiString—
Info UnicodeString—
Status— NTSTATUS reference
Client UnicodeString—
StatusCode HexInt32—
StatusString HexInt32—
FailuresCount Int64—
FailuresCountGlobal Int64—
SuccessCountGlobal Int64—

Event ID 15 — New client uses VBS Key Isolation.

#
Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Level
Informational
Task
VBSKeyIsolationoperation

Description

New client uses VBS Key Isolation.

Message #

New client uses VBS Key Isolation
Name: %1
Binding status: %2 (%3)
Client instance binding attempts: %4

Fields #

NameDescription
Client UnicodeStringName.
BindingStatusCode HexInt32Binding status.
BindingStatusString Int32—
InstanceBindingAttempts Int64Client instance binding attempts.
ImageBindingAttemptsClient overall binding attempts.
ActiveInstances—
ActiveInstancesMax—
InstancesLifetimeInstances across lifetime.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 0,
    "keywords": 9223372036854775816,
    "time_created": "2023-11-06T01:47:51.932692+00:00",
    "event_record_id": 46,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0001-0C49-DBE43710DA01"
    },
    "execution": {
      "process_id": 808,
      "thread_id": 15768
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Client": "chrome.exe",
    "BindingStatusCode": "0x80090029",
    "BindingStatusString": -2146893783,
    "InstanceBindingAttempts": 1,
    "ImageBindingAttempts": 2,
    "ActiveInstances": 1,
    "ActiveInstancesMax": 1,
    "InstancesLifetime": 2
  },
  "message": ""
}

References #

Event ID 16 — Cert-In-Use Message.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
CertInUse
Task
Cert_In_Use

Description

Cert-In-Use.

Message #

Cert-In-Use 

 Message:
 %1

Fields #

NameDescription
Message UnicodeString—

Event ID 17 — Cert-In-Use Failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
CertInUse
Task
Cert_In_UseError

Description

Cert-In-Use Failed.

Message #

Cert-In-Use Failed. 

 ErrorMessage:
 %1

Fields #

NameDescription
ErrorMessage UnicodeString—
Message UnicodeString—

Event ID 18 — Key Guard attestation operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

Key Guard attestation operation failed.

Message #

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Global %1 failures: %5
Global %1 successes: %6

Fields #

NameDescription
Function AnsiString—
Info UnicodeString—
StatusCode HexInt32—
StatusString HexInt32—
FailuresCountGlobal Int64—
SuccessCountGlobal Int64—

Event ID 19 — Key Guard attestation operation failed.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

Key Guard attestation operation failed.

Message #

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields #

NameDescription
Function AnsiString—
Info UnicodeString—
StatusCode HexInt32—
StatusString HexInt32—

Event ID 20 — VBS Key Isolation is not available.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

VBS Key Isolation is not available.

Message #

VBS Key Isolation is not available
Error: %1
Failed to signal: %2
Signaled: %3

Fields #

NameDescription
ErrorCode HexInt32—
SignaledFailure Int64—
SignaledSuccess Int64—

Event ID 21 — Key write succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt
Task
KeyManagementWriteKeyTask

Description

Key write succeeded.

Message #

Key write succeeded.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
ProviderName UnicodeString—
KeyModificationType HexInt32—
Flags HexInt32—
KeyName UnicodeString—
KeyFileName UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ThreadId HexInt32—
UserId UnicodeString—
ServiceTag UnicodeString—
Status HexInt32— NTSTATUS reference

Event ID 22 — Delete key succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt
Task
KeyManagementDeleteKeyTask

Description

Delete key succeeded.

Message #

Delete key succeeded.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

NameDescription
ProviderName UnicodeString—
Flags HexInt32—
DeletionType HexInt32—
KeyName UnicodeString—
KeyFileName UnicodeString—
ProcessName UnicodeString—
ProcessId HexInt32—
ThreadId HexInt32—
UserId UnicodeString—
ServiceTag UnicodeString—
Status HexInt32— NTSTATUS reference

Event ID 23 — Capi1 Container write succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt
Task
KeyManagementWriteKeyTask

Description

Capi1 Container write succeeded.

Message #

Capi1 Container write succeeded.

 Key Name: %1
 Key File Name: %2
 ProcessName: %3

Fields #

NameDescription
KeyName AnsiString—
KeyFileName UnicodeString—
ProcessName UnicodeString—

Event ID 24 — Capi1 Container Delete succeeded.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
KeyMgmt
Task
KeyManagementDeleteKeyTask

Description

Capi1 Container Delete succeeded.

Message #

Capi1 Container Delete succeeded.

 Key Name: %1
 Key File Name: %2
 ProcessName: %3

Fields #

NameDescription
KeyName AnsiString—
KeyFileName UnicodeString—
ProcessName UnicodeString—

Event ID 25 — VBS Key Isolation status: Status.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

VBS Key Isolation status: Status.

Message #

VBS Key Isolation status: %1

Fields #

NameDescription
Status UnicodeString— NTSTATUS reference

Event ID 26 — VBS Key Protection restart attempted.

Provider
Microsoft-Windows-Crypto-NCrypt
Channel
Operational
Task
VBSKeyIsolationoperation

Description

VBS Key Protection restart attempted.

Message #

VBS Key Protection restart attempted
LsaIsoLaunchAttempted: %1
Status: %2
TotalAttemptedRestarts: %3
TotalSuccessfulRestarts: %4
CanBeEnabled: %5

Fields #

NameDescription
LsaIsoLaunchAttempted Int64—
Status HexInt32— NTSTATUS reference
TotalAttemptedRestarts Int64—
TotalSuccessfulRestarts Int64—
CanBeEnabled Int64—