Microsoft-Windows-IdCtrls

33 events across 2 channels

Event ID	Title	Channel
5001	Cannot navigate to a non SSL URL - %1.	Operational
5002	Invalid web page on document complete from %1.	Operational
5003	Failed to navigate on %1 for TargetFrameName %2.	Operational
5004	Blocked a popup window from %1 for ReferrerUrl %2.	Operational
5005	Failed to navigate on wizard ID %1 through URL - %2.	Operational
5006	Failed to execute [.	Operational
5007	Failed to execute [.	Operational
5008	Failed to invoke command in host for DISPID %1 on parameter %2.	Operational
5009	Failed to navigate due to security problem %1.	Operational
5010	Failed to Get alternative URL for Wizard ID %1.	Operational
5011	Security manager handle URL %1 action %2 as policy %3.	Operational
5012	Security manager allow ActiveX control for CLSID %1.	Operational
5013	Security manager disallow ActiveX control for CLSID %1.	Operational
5014	QueryCustomPolicy(ObjectSafety) default action for CLSID %1.	Operational
5015	QueryCustomPolicy(ObjectSafety) disallowed for CLSID %1.	Operational
5016	QueryCustomPolicy(ObjectSafety) default action for GUID %1.	Operational
5017	Before navigate to %1.	Operational
5018	Navigate completed on %1.	Operational
5019	Document completed on %1.	Operational
5020	Navigate Redirected to %1.	Operational
5021	Window resized to cx: %1, cy: %2.	Operational
5022	Succeeded on executing [.	Operational
5023	Succeeded on executing [.	Operational
5024	Executed [.	Operational
5025	Showing browser window	Operational
5026	Showing progress window	Operational
5027	Failed to execute [.	Operational
7001		Analytic
7002		Analytic
7003		Analytic
7004		Analytic
7005		Analytic
7006		Analytic

Event ID 5001 — Cannot navigate to a non SSL URL - %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Cannot navigate to a non SSL URL - %1.

Fields

Name	Description
`URL`	—

Event ID 5002 — Invalid web page on document complete from %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Invalid web page on document complete from %1.

Fields

Name	Description
`URL`	—

Event ID 5003 — Failed to navigate on %1 for TargetFrameName %2.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to navigate on %1 for TargetFrameName %2. (StatusCode %3)

Fields

Name	Description
`URL`	—
`TargetFrameName`	—
`StatusCode`	—

Event ID 5004 — Blocked a popup window from %1 for ReferrerUrl %2.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Blocked a popup window from %1 for ReferrerUrl %2. (Flags %3)

Fields

Name	Description
`URL`	—
`ReferrerUrl`	—
`Flags`	—

Event ID 5005 — Failed to navigate on wizard ID %1 through URL - %2.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to navigate on wizard ID %1 through URL - %2. (Result %3)

Fields

Name	Description
`WizardID`	—
`URL`	—
`HRESULT`	—

Event ID 5006 — Failed to execute [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to execute [%1]. (Result %2)

Fields

Name	Description
`Method`	—
`HRESULT`	—

Event ID 5007 — Failed to execute [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to execute [%1] for [%2]. (Result %3)

Fields

Name	Description
`Method`	—
`String`	—
`HRESULT`	—

Event ID 5008 — Failed to invoke command in host for DISPID %1 on parameter %2.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to invoke command in host for DISPID %1 on parameter %2. (Result %3)

Fields

Name	Description
`DISPID`	—
`ArgErr`	—
`HRESULT`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5009 — Failed to navigate due to security problem %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to navigate due to security problem %1. (Result %2)

Fields

Name	Description
`SecurityProblem`	—
`HRESULT`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5010 — Failed to Get alternative URL for Wizard ID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to Get alternative URL for Wizard ID %1. (Result %2)

Fields

Name	Description
`WizardID`	—
`HRESULT`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5011 — Security manager handle URL %1 action %2 as policy %3.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Security manager handle URL %1 action %2 as policy %3. (Result %4)

Fields

Name	Description
`URL`	—
`Action`	—
`Policy`	—
`HRESULT`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5012 — Security manager allow ActiveX control for CLSID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Security manager allow ActiveX control for CLSID %1. (URL %2)

Fields

Name	Description
`CLSID`	—
`URL`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5013 — Security manager disallow ActiveX control for CLSID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Security manager disallow ActiveX control for CLSID %1. (URL %2)

Fields

Name	Description
`CLSID`	—
`URL`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5014 — QueryCustomPolicy(ObjectSafety) default action for CLSID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

QueryCustomPolicy(ObjectSafety) default action for CLSID %1. (URL %2)

Fields

Name	Description
`CLSID`	—
`URL`	—

Event ID 5015 — QueryCustomPolicy(ObjectSafety) disallowed for CLSID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

QueryCustomPolicy(ObjectSafety) disallowed for CLSID %1. (URL %2)

Fields

Name	Description
`CLSID`	—
`URL`	—

Event ID 5016 — QueryCustomPolicy(ObjectSafety) default action for GUID %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

QueryCustomPolicy(ObjectSafety) default action for GUID %1. (URL %2)

Fields

Name	Description
`CLSID`	—
`URL`	—

Event ID 5017 — Before navigate to %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Before navigate to %1.

Fields

Name	Description
`URL`	—

Event ID 5018 — Navigate completed on %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Navigate completed on %1.

Fields

Name	Description
`URL`	—

Event ID 5019 — Document completed on %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Document completed on %1.

Fields

Name	Description
`URL`	—

Event ID 5020 — Navigate Redirected to %1.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Navigate Redirected to %1.

Fields

Name	Description
`URL`	—

Event ID 5021 — Window resized to cx: %1, cy: %2.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Window resized to cx: %1, cy: %2.

Fields

Name	Description
`cx`	—
`cy`	—

Event ID 5022 — Succeeded on executing [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Succeeded on executing [%1].

Fields

Name	Description
`Method`	—

Event ID 5023 — Succeeded on executing [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Succeeded on executing [%1] for [%2].

Fields

Name	Description
`Method`	—
`String`	—

Event ID 5024 — Executed [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Executed [%1] for [%2]. (Result %3)

Fields

Name	Description
`Method`	—
`String`	—
`HRESULT`	—

Event ID 5025 — Showing browser window

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Showing browser window

References

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5025

Event ID 5026 — Showing progress window

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Showing progress window

Event ID 5027 — Failed to execute [.

Provider: Microsoft-Windows-IdCtrls
Channel: Operational

Message

Failed to execute [%1] for [%2]. Extended error text: %3. (Result %4)

Fields

Name	Description
`Method`	—
`String`	—
`Extended String`	—
`HRESULT`	—
`ExtendedString`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5027
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5027

Event ID 7001 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic

Event ID 7002 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic

Event ID 7003 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic

Event ID 7004 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic

Event ID 7005 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic

Event ID 7006 —

Provider: Microsoft-Windows-IdCtrls
Channel: Analytic