Microsoft-Windows-Shell-AuthUI

291 events across 8 channels

Event	Title	Channel
5001	Logon user interface creation failed.	Operational
5002	Logon user interface RPC server startup failed.	Operational
5003	The username/password credential provider failed to enumerate tiles.	Operational
5004	Autologon failed.	Operational
5005	The autologon password could not be loaded.	Operational
5006	The autologon password could not be loaded.	Operational
5007	The OEM background could not be loaded for resolution DWORD1 x DWORD2.	Operational
5008	The OEM background Error was loaded but its aspect ratio does not match the …	Operational
5009	The OEM background Error was not loaded because the file is larger than DWORD1 …	Operational
5010	The credential provider thread creation failed.	Operational
5011	User enumeration failed.	Operational
5012	The first run task for package PackageFullName exceeded the maximum runtime …	Operational
5013	The autologon setting has been removed because AutoLogonSettingRemovalReason.	Operational
15001	Common_UserList_TileEnumerationStart	Diagnostic
15002	Common_UserList_TileEnumerationStop	Diagnostic
15003	Common_GetMachineNameStart	Diagnostic
15004	Common_GetMachineNameStop	Diagnostic
15005	Common_GetMachineDomainNameStart	Diagnostic
15006	Common_GetMachineDomainNameStop	Diagnostic
15007	Common_GetBuiltInAdministratorStart	Diagnostic
15008	Common_GetBuiltInAdministratorStop	Diagnostic
15009	Common_GetInSessionUserStart	Diagnostic
15010	Common_GetInSessionUserStop	Diagnostic
15011	Common_GetFriendlyNameStart	Diagnostic
15012	Common_GetFriendlyNameStop	Diagnostic
15013	Common_Tile_FireSubmitEvent	Diagnostic
15014	Common_CreateCredentialProvidersStart	Diagnostic
15015	Common_CreateCredentialProvidersStop	Diagnostic
15016	Common_AddCredProvider	Diagnostic
15017	Common_CreateCredProviderThreadStart	Diagnostic
15018	Common_CreateCredProviderThreadStop	Diagnostic
15019	Common_CredProviderThreadProcStart	Diagnostic
15020	Common_CredProviderThreadProcStop	Diagnostic
15021	Common_CredProviderThreadDestroyStart	Diagnostic
15022	Common_CredProviderThreadDestroyStop	Diagnostic
15023	Common_SetUsageScenario	Diagnostic
15024	Common_SetSerialization	Diagnostic
15025	Common_GetCredentialAt	Diagnostic
15026	Common_GetCredentialCount	Diagnostic
15027	Common_GetFieldDescriptorCount	Diagnostic
15028	Common_Credential_GetUserSid	Diagnostic
15029	Common_SetSelected	Diagnostic
15030	Common_SetDeSelected	Diagnostic
15031	Common_GetSerialization	Diagnostic
15032	Common_ReportResult	Diagnostic
15033	Common_RegisterEnumerationStart	Diagnostic
15034	Common_RegisterEnumerationStop	Diagnostic
15035	Common_CreateEnumerationSyncReply	Diagnostic
15036	Common_StartCredProvsForUsageScenario	Diagnostic
25001	Logon_ServerCallback_AbortStart	Diagnostic
25002	Logon_ServerCallback_AbortStop	Diagnostic
25003	Logon_ServerCallback_DisplayLockedStart	Diagnostic
25004	Logon_ServerCallback_DisplayLockedStop	Diagnostic
25005	Logon_ServerCallback_DisplayMessageStart	Diagnostic
25006	Logon_ServerCallback_DisplayMessageStop	Diagnostic
25007	Logon_ServerCallback_DisplayRequestCredentialsErrorStart	Diagnostic
25008	Logon_ServerCallback_DisplayRequestCredentialsErrorStop	Diagnostic
25009	Logon_ServerCallback_DisplaySecurityOptionsStart	Diagnostic
25010	Logon_ServerCallback_DisplaySecurityOptionsStop	Diagnostic
25011	Logon_ServerCallback_DisplayStatusStart	Diagnostic
25012	Logon_ServerCallback_DisplayStatusStop	Diagnostic
25013	Logon_ServerCallback_DisplayWelcomeStart	Diagnostic
25014	Logon_ServerCallback_DisplayWelcomeStop	Diagnostic
25015	Logon_ServerCallback_ReportResultStart	Diagnostic
25016	Logon_ServerCallback_ReportResultStop	Diagnostic
25017	Logon_ServerCallback_RequestCredentialsStart	Diagnostic
25018	Logon_ServerCallback_RequestCredentialsStop	Diagnostic
25019	Logon_ServerCallback_ShutdownStart	Diagnostic
25020	Logon_ServerCallback_ShutdownStop	Diagnostic
25021	Logon_ServerCallback_PromptForCredentialsStart	Diagnostic
25022	Logon_ServerCallback_PromptForCredentialsStop	Diagnostic
25023	Logon_LogonFrame_OnSwitchUserStart	Diagnostic
25024	Logon_LogonFrame_OnSwitchUserStop	Diagnostic
25025	Logon_LogonFrame_OnOtherTilesStart	Diagnostic
25026	Logon_LogonFrame_OnOtherTilesStop	Diagnostic
25027	Logon_LogonFrame_OnGetEnumeratedTilesReplyStart	Diagnostic
25028	Logon_LogonFrame_OnGetEnumeratedTilesReplyStop	Diagnostic
25029	Logon_LogonFrame_OnEnumerationSyncReplyStart	Diagnostic
25030	Logon_LogonFrame_OnEnumerationSyncReplyStop	Diagnostic
25031	Logon_LogonFrame_OnSelectCredentialReplyStart	Diagnostic
25032	Logon_LogonFrame_OnSelectCredentialReplyStop	Diagnostic
25033	Logon_LogonFrame_SetBackgroundGraphicsStart	Diagnostic
25034	Logon_LogonFrame_SetBackgroundGraphicsStop	Diagnostic
25035	Logon_LogonFrame_InitializeFrameStart	Diagnostic
25036	Logon_LogonFrame_InitializeFrameStop	Diagnostic
25037	Logon_LogonFrame_CreateStyleParserStart	Diagnostic
25038	Logon_LogonFrame_CreateStyleParserStop	Diagnostic
25039	Logon_LogonFrame_CreateFrameElementStart	Diagnostic
25040	Logon_LogonFrame_CreateFrameElementStop	Diagnostic
25041	Logon_LogonFrame_InitializeUserListsStart	Diagnostic
25042	Logon_LogonFrame_InitializeUserListsStop	Diagnostic
25043	Logon_LogonFrame_BrandingLoadImageStart	Diagnostic
25044	Logon_LogonFrame_BrandingLoadImageStop	Diagnostic
25047	Logon_LogonFrame_InitializeSoftKeyboardStart	Diagnostic
25048	Logon_LogonFrame_InitializeSoftKeyboardStop	Diagnostic
25049	Logon_LogonFrame_WTSRegisterSessionNotificationStart	Diagnostic
25050	Logon_LogonFrame_WTSRegisterSessionNotificationStop	Diagnostic
25051	Logon_AutoLogon_IsSingleUserNoPasswordStart	Diagnostic
25052	Logon_AutoLogon_IsSingleUserNoPasswordStop	Diagnostic
25053	Logon_AutoLogon_IsLocalNoPasswordUserStart	Diagnostic
25054	Logon_AutoLogon_IsSingleUserNoPasswordStop25054	Diagnostic
25055	Logon_ServerStartupStart	Diagnostic
25056	Logon_ServerStartupStop	Diagnostic
25057	Logon_LaunchToReadyForInputStart	Diagnostic
25058	Logon_LaunchToReadyForInputStop	Diagnostic
25059	Logon_CredentialsToExitStart	Diagnostic
25060	Logon_CredentialsToExitStop	Diagnostic
25061	Logon_RequestCredentialsToReadyForCredentialsStart	Diagnostic
25062	Logon_RequestCredentialsToReadyForCredentialsStop	Diagnostic
25063	Logon_LaunchToAnimationCompleteStart	Diagnostic
25064	Logon_LaunchToAnimationCompleteStop	Diagnostic
25065	LogonUI_PerfTrack_UserSwitchingStop	Diagnostic
25066	Logon_RequestCredentialsToCancelAfterEnumerateStop	Diagnostic
25068	Logon_LaunchToCancelAfterResumeStop	Diagnostic
25072	LogonUI_SubmitCredentialToExitStart	Diagnostic
25073	LogonUI_SubmitCredentialToExitStop	Diagnostic
25074	Logon_LogonFrame_OnGetSerializationReply	Diagnostic
25075	Logon_LogonFrame_OnProviderCredentialsChanged	Diagnostic
25076	Logon_LogonFrame_DisplayStatusMessage	Diagnostic
25077	Logon_LogonFrame_LogonDialogCallback	Diagnostic
25078	Logon_LogonFrame_DisplayLogonDialog	Diagnostic
25079	Logon_Background_GetBackgroundForUser	Diagnostic
25080	Logon_Background_ShowUserBackground	Diagnostic
25082	Logon_AccessPage_LoadBackgroundImageStart	Diagnostic
25083	Logon_AccessPage_LoadBackgroundImageStop	Diagnostic
25084	Logon_AutoLogon_QueryAutoLogon_Info	Diagnostic
25085	Logon_AutoLogon_IgnoreAutoLogonMode_Info	Diagnostic
25087	Logon_BSDR_InitializeStart	Diagnostic
25088	Logon_BSDR_InitializeStop	Diagnostic
25089	Logon_BSDR_Shown	Diagnostic
25090	Logon_BSDR_AddApplicationStart	Diagnostic
25091	Logon_BSDR_AddApplicationStop	Diagnostic
25093	Logon_BSDR_RemoveApplicationStart	Diagnostic
25094	Logon_BSDR_RemoveApplicationStop	Diagnostic
25095	LogonUI_SubmitCredentialToExitStop25095	Diagnostic
25096	LogonUI_PerfTrack_LockStop	Diagnostic
25097	Logon_LanguageProfile_SwitchInputMethodsStart	Diagnostic
25098	Logon_LanguageProfile_SwitchInputMethodsStop	Diagnostic
25099	Logon_AccessPage_CancelFirstRunTasksStart	Diagnostic
25100	Logon_AccessPage_CancelFirstRunTasksStop	Diagnostic
25101	Logon_AccessPage_CancelFirstRunTasks	Diagnostic
25102	Logon_AccessPage_TriggerFirstRunTasksStart	Diagnostic
25103	Logon_AccessPage_TriggerFirstRunTasksStop	Diagnostic
25104	Logon_AccessPage_WaitForFirstRunTasksStart	Diagnostic
25105	Logon_AccessPage_WaitForFirstRunTasksStop	Diagnostic
25106	Logon_BackButtonNotificationFlyoutStart	Diagnostic
25107	Logon_BackButtonNotificationFlyoutStop	Diagnostic
25108	Logon_AccessPage_UnlockStart	Diagnostic
25109	Logon_AccessPage_UnlockStop	Diagnostic
25110	Logon_AccessPage_LockStart	Diagnostic
25111	Logon_AccessPage_LockStop	Diagnostic
25112	Logon_AccessPage_Lock	Diagnostic
25113	Logon_AccessPage_Camera_ControlCreationStart	Diagnostic
25114	Logon_AccessPage_Camera_ControlCreationStop	Diagnostic
25115	Logon_AccessPage_Camera_ViewfinderInitializationStart	Diagnostic
25116	Logon_AccessPage_Camera_ViewfinderInitializationStop	Diagnostic
25117	Logon_AccessPage_Camera_ActiveDurationStart	Diagnostic
25118	Logon_AccessPage_Camera_ActiveDurationStop	Diagnostic
25119	Logon_AccessPage_Camera_ShutdownDurationStart	Diagnostic
25120	Logon_AccessPage_Camera_ShutdownDurationStop	Diagnostic
35001	CredUI_Prompt_Called	Diagnostic
35002	CredUI_Dialog_CreatedStart	Diagnostic
35003	CredUI_Dialog_CreatedStop	Diagnostic
35004	CredUI_UserList_TileEnumeration	Diagnostic
35005	CredUI_Dialog_Destroyed	Diagnostic
35006	CredUI_Dialog_DUIInitializeStart	Diagnostic
35007	CredUI_Dialog_DUIInitializeStop	Diagnostic
35008	CredUI_Dialog_LoadStyleSheetStart	Diagnostic
35009	CredUI_Dialog_LoadStyleSheetStop	Diagnostic
35010	CredUI_ModernDialog_CreatedStart	Diagnostic
35011	CredUI_ModernDialog_CreatedStop	Diagnostic
35012	CredUI_ModernDialog_DUIInitializeStart	Diagnostic
35013	CredUI_ModernDialog_DUIInitializeStop	Diagnostic
35014	CredUI_ModernDialog_LoadStyleSheetStart	Diagnostic
35015	CredUI_ModernDialog_LoadStyleSheetStop	Diagnostic
35016	CredUI_EnumerationSyncStop	Diagnostic
45001	Shutdown_ShutdownChoices_UserHasShutdownRightsStart	Diagnostic
45002	Shutdown_ShutdownChoices_UserHasShutdownRightsStop	Diagnostic
45003	Shutdown_ShutdownFlyout_CreateAndShowStart	Diagnostic
45004	Shutdown_ShutdownFlyout_CreateAndShowStop	Diagnostic
45005	Shutdown_ShutdownFlyout_PromptForReasonStart	Diagnostic
45006	Shutdown_ShutdownFlyout_PromptForReasonStop	Diagnostic
45007	Shutdown_ShutdownFlyout_PromptForConfirmationStart	Diagnostic
45008	Shutdown_ShutdownFlyout_PromptForConfirmationStop	Diagnostic
45009	Shutdown_ShutdownFlyout_InitiatePowerTransitionStart	Diagnostic
45010	Shutdown_ShutdownFlyout_InitiatePowerTransitionStop	Diagnostic
45011	Shutdown_SlideToShutDownScreen_InitializeStart	Diagnostic
45012	Shutdown_SlideToShutDownScreen_InitializeStop	Diagnostic
45013	Shutdown_SlideToShutDownScreen_ShowModalStart	Diagnostic
45014	Shutdown_SlideToShutDownScreen_ShowModalStop	Diagnostic
45015	Shutdown_SlideToShutDownScreen_SelfRevealAnimationStart	Diagnostic
45016	Shutdown_SlideToShutDownScreen_SelfRevealAnimationStop	Diagnostic
45017	Shutdown_SlideToShutDownScreen_DismissStart	Diagnostic
45018	Shutdown_SlideToShutDownScreen_DismissStop	Diagnostic
45019	Shutdown_SlideToShutDownScreen_Timeout	Diagnostic
55001	CredentialProviderUser_EnumerateLogonUsersStart	Diagnostic
55002	CredentialProviderUser_EnumerateLogonUsersStop	Diagnostic
55003	CredentialProviderUser_EnumerateLastLoggedOnUserStart	Diagnostic
55004	CredentialProviderUser_EnumerateLastLoggedOnUserStop	Diagnostic
55005	CredentialProviderUser_EnumerateAutoLogonUserStart	Diagnostic
55006	CredentialProviderUser_EnumerateAutoLogonUserStop	Diagnostic
55007	CredentialProviderUser_EnumerateInSessionUserStart	Diagnostic
55008	CredentialProviderUser_EnumerateInSessionUserStop	Diagnostic
55009	CredentialProviderUser_EnumerateLocalAdminsStart	Diagnostic
55010	CredentialProviderUser_EnumerateLocalAdminsStop	Diagnostic
55011	CredentialProviderUser_Init_CredentialProviderUserArrayStart	Diagnostic
55012	CredentialProviderUser_Init_CredentialProviderUserArrayStop	Diagnostic
55013	CredentialProviderUser_CloneUserArray	Diagnostic
55014	CredentialProviderUser_SetProviderFilter	Diagnostic
55015	CredentialProviderUser_GetAccountOptions	Diagnostic
61001	PicturePassword_LaunchEnrollmentUX	Diagnostic
61002	PicturePassword_EnrollmentUXTeachingShown	Diagnostic
61003	PicturePassword_EnrollmentUXImageConfirmationShown	Diagnostic
61004	PicturePassword_EnrollmentUXRelearnShown	Diagnostic
61005	PicturePassword_EnrollmentUXGestureEntryShown	Diagnostic
61006	PicturePassword_EnrollmentUXGestureConfirmationShown	Diagnostic
61007	PicturePassword_EnrollmentUXEnrollmentConfirmationShown	Diagnostic
61008	PicturePassword_EnrollmentUXErrorShown	Diagnostic
61009	PicturePassword_RenderFeedbackStart	Diagnostic
61010	PicturePassword_RenderFeedbackStop	Diagnostic
61011	PicturePassword_FeedbackVisibleStart	Diagnostic
61012	PicturePassword_FeedbackVisibleStop	Diagnostic
61013	PicturePassword_SubmitEnrollmentToSystemStart	Diagnostic
61014	PicturePassword_SubmitEnrollmentToSystemStop	Diagnostic
61015	PicturePassword_SanitizeImageStart	Diagnostic
61016	PicturePassword_SanitizeImageStop	Diagnostic
61017	PicturePassword_EnrollmentHandlerCreate	Diagnostic
61018	PicturePassword_EnrollmentHandlerGetEnrollmentStatusStart	Diagnostic
61019	PicturePassword_EnrollmentHandlerGetEnrollmentStatusStop	Diagnostic
61020	PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStart	Diagnostic
61021	PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStop	Diagnostic
61022	PicturePassword_EnrollmentHandlerSetEnrollmentStart	Diagnostic
61023	PicturePassword_EnrollmentHandlerSetEnrollmentStop	Diagnostic
61024	PicturePassword_EnrollmentHandlerClearEnrollmentStart	Diagnostic
61025	PicturePassword_EnrollmentHandlerClearEnrollmentStop	Diagnostic
61026	PicturePassword_CredentialCreate	Diagnostic
61027	PicturePassword_CredentialSelected	Diagnostic
61028	PicturePassword_CredentialDeselected	Diagnostic
61029	PicturePassword_CredentialSetSubmitData	Diagnostic
61030	PicturePassword_CredentialGetSerializationStart	Diagnostic
61031	PicturePassword_CredentialGetSerializationStop	Diagnostic
61032	PicturePassword_SyncedImageLoadingStart	Diagnostic
61033	PicturePassword_SyncedImageLoadingStop	Diagnostic
61034	PicturePassword_EnrollmentImageSavingForRoamingStart	Diagnostic
61035	PicturePassword_EnrollmentImageSavingForRoamingStop	Diagnostic
61036	PicturePassword_SyncedImageSelected	Diagnostic
61037	PicturePassword_CheckRoamingImageAvailable	Diagnostic
64001	LockScreenCall_AcceptCallStart	Diagnostic
64002	LockScreenCall_AcceptCallStop	Diagnostic
64003	LockScreenCall_QueueCallStart	Diagnostic
64004	LockScreenCall_QueueCallStop	Diagnostic
64005	LockScreenCall_StartCallStart	Diagnostic
64006	LockScreenCall_StartCallStop	Diagnostic
64007	LockScreenCall_EndCallStart	Diagnostic
64008	LockScreenCall_EndCallStop	Diagnostic
64009	LockScreenCall_EvictCallStart	Diagnostic
64010	LockScreenCall_EvictCallStop	Diagnostic
64501	LockScreenCallBroker_StartCallStart	Diagnostic
64502	LockScreenCallBroker_StartCallStop	Diagnostic
64503	LockScreenCallBroker_EndCallStart	Diagnostic
64504	LockScreenCallBroker_EndCallStop	Diagnostic
64505	LockScreenCallBroker_OnUnlockingStart	Diagnostic
64506	LockScreenCallBroker_OnUnlockingStop	Diagnostic
64507	LockScreenCallBroker_EventSignaled	Diagnostic
64508	LockScreenCallBroker_HostExited	Diagnostic
64509	LockScreenCallBroker_AccessibleNameChanged	Diagnostic
64510	LockScreenCallBroker_AppExited	Diagnostic
65001	Booting_Animation_DoPearlSyncStart	Diagnostic
65002	Booting_Animation_DoPearlSyncStop	Diagnostic
65003	Booting_Animation_InitStart	Diagnostic
65004	Booting_Animation_InitStop	Diagnostic
65005	Booting_Animation_TimerProcStart	Diagnostic
65006	Booting_Animation_TimerProcStop	Diagnostic
65007	Booting_Animation_LoadImgStart	Diagnostic
65008	Booting_Animation_LoadImgStop	Diagnostic
65009	Booting_Animation_AnimationCompleteProcStart	Diagnostic
65010	Booting_Animation_AnimationCompleteProcStop	Diagnostic
65011	Booting_Animation_AnimCallbackObjLifetimeStart	Diagnostic
65012	Booting_Animation_AnimCallbackObjLifetimeStop	Diagnostic
65013	Booting_Animation_PlaySoundThreadStart	Diagnostic
65014	Booting_Animation_PlaySoundThreadStop	Diagnostic
65015	Booting_Animation_InitAudioThreadStart	Diagnostic
65016	Booting_Animation_InitAudioThreadStop	Diagnostic
65017	Booting_Animation_AttachToMMCSSStart	Diagnostic
65018	Booting_Animation_AttachToMMCSSStop	Diagnostic
65019	Logon_LogonFrame_InitializeInputIndicatorStart	Diagnostic
65020	Logon_LogonFrame_InitializeInputIndicatorStop	Diagnostic
65030	LockscreenNotifications_NotificationUpdatedStart	Diagnostic
65031	LockscreenNotifications_NotificationUpdatedStop	Diagnostic
65032	LockscreenNotifications_NotificationArrivedStart	Diagnostic
65033	LockscreenNotifications_NotificationArrivedStop	Diagnostic

Event ID 5001: Logon user interface creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface creation failed. Details: Error.

Message #

Logon user interface creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5002: Logon user interface RPC server startup failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface RPC server startup failed. Details: Error.

Message #

Logon user interface RPC server startup failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5003: The username/password credential provider failed to enumerate tiles.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The username/password credential provider failed to enumerate tiles.

Message #

The username/password credential provider failed to enumerate tiles.

Event ID 5004: Autologon failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Autologon failed. Details: Error.

Message #

Autologon failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5005: The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded.

Message #

The autologon password could not be loaded.

Event ID 5006: The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded. Details: Error.

Message #

The autologon password could not be loaded.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5007: The OEM background could not be loaded for resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background could not be loaded for resolution DWORD1 x DWORD2. Details: Error.

Message #

The OEM background could not be loaded for resolution %2 x %3.  Details: %1

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 5008: The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Message #

The OEM background %1 was loaded but its aspect ratio does not match the primary display resolution %2 x %3.

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 5009: The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Message #

The OEM background %1 was not loaded because the file is larger than %2 bytes.

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 5010: The credential provider thread creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The credential provider thread creation failed. Details: Error.

Message #

The credential provider thread creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5011: User enumeration failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

User enumeration failed. Details: Error.

Message #

User enumeration failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5012: The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Message #

The first run task for package %1 exceeded the maximum runtime alotted and has been cancelled.

Fields #

Name	Description
`PackageFullName` UnicodeString

Event ID 5013: The autologon setting has been removed because AutoLogonSettingRemovalReason.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon setting has been removed because AutoLogonSettingRemovalReason.

Message #

The autologon setting has been removed because %1.

Fields #

Name	Description
`AutoLogonSettingRemovalReason` UInt32

Event ID 15001: Common_UserList_TileEnumerationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Start

Event ID 15002: Common_UserList_TileEnumerationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Stop

Event ID 15003: Common_GetMachineNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Start

Event ID 15004: Common_GetMachineNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Stop

Event ID 15005: Common_GetMachineDomainNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Start

Event ID 15006: Common_GetMachineDomainNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Stop

Event ID 15007: Common_GetBuiltInAdministratorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Start

Event ID 15008: Common_GetBuiltInAdministratorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Stop

Event ID 15009: Common_GetInSessionUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Start

Event ID 15010: Common_GetInSessionUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Stop

Event ID 15011: Common_GetFriendlyNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Start

Event ID 15012: Common_GetFriendlyNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Stop

Event ID 15013: Common_Tile_FireSubmitEvent

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Tile_FireSubmitEvent

Event ID 15014: Common_CreateCredentialProvidersStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Start

Event ID 15015: Common_CreateCredentialProvidersStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Stop

Event ID 15016: Common_AddCredProvider

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_AddCredProvider

Fields #

Name	Description
`message1` UnicodeString

Event ID 15017: Common_CreateCredProviderThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Start

Event ID 15018: Common_CreateCredProviderThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15019: Common_CredProviderThreadProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Start

Event ID 15020: Common_CredProviderThreadProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15021: Common_CredProviderThreadDestroyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Start

Event ID 15022: Common_CredProviderThreadDestroyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Stop

Event ID 15023: Common_SetUsageScenario

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetUsageScenario

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32

Event ID 15024: Common_SetSerialization

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSerialization

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 15025: Common_GetCredentialAt

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialAt

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15026: Common_GetCredentialCount

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialCount

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32
`Boolean1` Boolean

Event ID 15027: Common_GetFieldDescriptorCount

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFieldDescriptorCount

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15028: Common_Credential_GetUserSid

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Credential_GetUserSid

Fields #

Name	Description
`DWORD1` UInt32
`message1` UnicodeString
`message2` UnicodeString

Event ID 15029: Common_SetSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSelected

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15030: Common_SetDeSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetDeSelected

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15031: Common_GetSerialization

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetSerialization

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15032: Common_ReportResult

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_ReportResult

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32
`DWORD3` UInt32

Event ID 15033: Common_RegisterEnumerationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Start

Event ID 15034: Common_RegisterEnumerationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Stop

Event ID 15035: Common_CreateEnumerationSyncReply

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateEnumerationSyncReply

Event ID 15036: Common_StartCredProvsForUsageScenario

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_StartCredProvsForUsageScenario

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 25001: Logon_ServerCallback_AbortStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Start

Event ID 25002: Logon_ServerCallback_AbortStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Stop

Event ID 25003: Logon_ServerCallback_DisplayLockedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Start

Event ID 25004: Logon_ServerCallback_DisplayLockedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Stop

Event ID 25005: Logon_ServerCallback_DisplayMessageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Start

Event ID 25006: Logon_ServerCallback_DisplayMessageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Stop

Event ID 25007: Logon_ServerCallback_DisplayRequestCredentialsErrorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Start

Event ID 25008: Logon_ServerCallback_DisplayRequestCredentialsErrorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Stop

Event ID 25009: Logon_ServerCallback_DisplaySecurityOptionsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Start

Event ID 25010: Logon_ServerCallback_DisplaySecurityOptionsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Stop

Event ID 25011: Logon_ServerCallback_DisplayStatusStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Start

Event ID 25012: Logon_ServerCallback_DisplayStatusStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Stop

Event ID 25013: Logon_ServerCallback_DisplayWelcomeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Start

Event ID 25014: Logon_ServerCallback_DisplayWelcomeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Stop

Event ID 25015: Logon_ServerCallback_ReportResultStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Start

Event ID 25016: Logon_ServerCallback_ReportResultStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Stop

Event ID 25017: Logon_ServerCallback_RequestCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Start

Event ID 25018: Logon_ServerCallback_RequestCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Stop

Event ID 25019: Logon_ServerCallback_ShutdownStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Start

Event ID 25020: Logon_ServerCallback_ShutdownStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Stop

Event ID 25021: Logon_ServerCallback_PromptForCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Start

Event ID 25022: Logon_ServerCallback_PromptForCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Stop

Event ID 25023: Logon_LogonFrame_OnSwitchUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Start

Event ID 25024: Logon_LogonFrame_OnSwitchUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Stop

Event ID 25025: Logon_LogonFrame_OnOtherTilesStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Start

Event ID 25026: Logon_LogonFrame_OnOtherTilesStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Stop

Event ID 25027: Logon_LogonFrame_OnGetEnumeratedTilesReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Start

Event ID 25028: Logon_LogonFrame_OnGetEnumeratedTilesReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Stop

Event ID 25029: Logon_LogonFrame_OnEnumerationSyncReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Start

Event ID 25030: Logon_LogonFrame_OnEnumerationSyncReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Stop

Event ID 25031: Logon_LogonFrame_OnSelectCredentialReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Start

Event ID 25032: Logon_LogonFrame_OnSelectCredentialReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Stop

Event ID 25033: Logon_LogonFrame_SetBackgroundGraphicsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Start

Event ID 25034: Logon_LogonFrame_SetBackgroundGraphicsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Stop

Event ID 25035: Logon_LogonFrame_InitializeFrameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Start

Event ID 25036: Logon_LogonFrame_InitializeFrameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Stop

Event ID 25037: Logon_LogonFrame_CreateStyleParserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Start

Event ID 25038: Logon_LogonFrame_CreateStyleParserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Stop

Event ID 25039: Logon_LogonFrame_CreateFrameElementStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Start

Event ID 25040: Logon_LogonFrame_CreateFrameElementStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Stop

Event ID 25041: Logon_LogonFrame_InitializeUserListsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Start

Event ID 25042: Logon_LogonFrame_InitializeUserListsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Stop

Event ID 25043: Logon_LogonFrame_BrandingLoadImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Start

Event ID 25044: Logon_LogonFrame_BrandingLoadImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Stop

Event ID 25047: Logon_LogonFrame_InitializeSoftKeyboardStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Start

Event ID 25048: Logon_LogonFrame_InitializeSoftKeyboardStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Stop

Event ID 25049: Logon_LogonFrame_WTSRegisterSessionNotificationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Start

Event ID 25050: Logon_LogonFrame_WTSRegisterSessionNotificationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Stop

Event ID 25051: Logon_AutoLogon_IsSingleUserNoPasswordStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Start

Event ID 25052: Logon_AutoLogon_IsSingleUserNoPasswordStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Fields #

Name	Description
`Boolean1` Boolean

Event ID 25053: Logon_AutoLogon_IsLocalNoPasswordUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsLocalNoPasswordUser
Opcode: Start

Event ID 25054: Logon_AutoLogon_IsSingleUserNoPasswordStop25054

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Event ID 25055: Logon_ServerStartupStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Start

Event ID 25056: Logon_ServerStartupStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Stop

Event ID 25057: Logon_LaunchToReadyForInputStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Start

Event ID 25058: Logon_LaunchToReadyForInputStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32

Event ID 25059: Logon_CredentialsToExitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Start

Event ID 25060: Logon_CredentialsToExitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Stop

Event ID 25061: Logon_RequestCredentialsToReadyForCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Start

Event ID 25062: Logon_RequestCredentialsToReadyForCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32

Event ID 25063: Logon_LaunchToAnimationCompleteStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Start

Event ID 25064: Logon_LaunchToAnimationCompleteStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Stop

Event ID 25065: LogonUI_PerfTrack_UserSwitchingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_UserSwitching
Opcode: Stop

Event ID 25066: Logon_RequestCredentialsToCancelAfterEnumerateStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToCancelAfterEnumerate
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32

Event ID 25068: Logon_LaunchToCancelAfterResumeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToCancelAfterResume
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32

Event ID 25072: LogonUI_SubmitCredentialToExitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Start

Event ID 25073: LogonUI_SubmitCredentialToExitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Fields #

Name	Description
`UserType` UInt32
`CredProvCount` UInt32
`IsLogonScenario` UInt32
`IsFirstLogon` UInt32

Event ID 25074: Logon_LogonFrame_OnGetSerializationReply

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetSerializationReply

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25075: Logon_LogonFrame_OnProviderCredentialsChanged

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnProviderCredentialsChanged

Fields #

Name	Description
`Boolean1` Boolean

Event ID 25076: Logon_LogonFrame_DisplayStatusMessage

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayStatusMessage

Fields #

Name	Description
`message1` UnicodeString

Event ID 25077: Logon_LogonFrame_LogonDialogCallback

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_LogonDialogCallback

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25078: Logon_LogonFrame_DisplayLogonDialog

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayLogonDialog

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25079: Logon_Background_GetBackgroundForUser

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_GetBackgroundForUser

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25080: Logon_Background_ShowUserBackground

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_ShowUserBackground

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25082: Logon_AccessPage_LoadBackgroundImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Start

Event ID 25083: Logon_AccessPage_LoadBackgroundImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Stop

Event ID 25084: Logon_AutoLogon_QueryAutoLogon_Info

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_QueryAutoLogon_Info

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32
`DWORD3` UInt32
`DWORD4` UInt32
`DWORD5` UInt32

Event ID 25085: Logon_AutoLogon_IgnoreAutoLogonMode_Info

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IgnoreAutoLogonMode_Info

Event ID 25087: Logon_BSDR_InitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Start

Event ID 25088: Logon_BSDR_InitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Stop

Event ID 25089: Logon_BSDR_Shown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Shown

Event ID 25090: Logon_BSDR_AddApplicationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32

Event ID 25091: Logon_BSDR_AddApplicationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Stop

Event ID 25093: Logon_BSDR_RemoveApplicationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Start

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25094: Logon_BSDR_RemoveApplicationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Stop

Event ID 25095: LogonUI_SubmitCredentialToExitStop25095

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Event ID 25096: LogonUI_PerfTrack_LockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_Lock
Opcode: Stop

Event ID 25097: Logon_LanguageProfile_SwitchInputMethodsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Start

Event ID 25098: Logon_LanguageProfile_SwitchInputMethodsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Stop

Event ID 25099: Logon_AccessPage_CancelFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Start

Event ID 25100: Logon_AccessPage_CancelFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Stop

Fields #

Name	Description
`OutstandingTasks` UInt32
`TasksCancelled` UInt32

Event ID 25101: Logon_AccessPage_CancelFirstRunTasks

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks

Fields #

Name	Description
`PackageFullName` UnicodeString

Event ID 25102: Logon_AccessPage_TriggerFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Start

Event ID 25103: Logon_AccessPage_TriggerFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Stop

Event ID 25104: Logon_AccessPage_WaitForFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Start

Event ID 25105: Logon_AccessPage_WaitForFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Stop

Event ID 25106: Logon_BackButtonNotificationFlyoutStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Start

Event ID 25107: Logon_BackButtonNotificationFlyoutStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Stop

Event ID 25108: Logon_AccessPage_UnlockStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Start

Event ID 25109: Logon_AccessPage_UnlockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Stop

Event ID 25110: Logon_AccessPage_LockStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Start

Event ID 25111: Logon_AccessPage_LockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Stop

Event ID 25112: Logon_AccessPage_Lock

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock

Event ID 25113: Logon_AccessPage_Camera_ControlCreationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Start

Fields #

Name	Description
`InvokeObject` UInt32

Event ID 25114: Logon_AccessPage_Camera_ControlCreationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 25115: Logon_AccessPage_Camera_ViewfinderInitializationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Start

Event ID 25116: Logon_AccessPage_Camera_ViewfinderInitializationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 25117: Logon_AccessPage_Camera_ActiveDurationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Start

Event ID 25118: Logon_AccessPage_Camera_ActiveDurationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Stop

Event ID 25119: Logon_AccessPage_Camera_ShutdownDurationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Start

Event ID 25120: Logon_AccessPage_Camera_ShutdownDurationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Stop

Event ID 35001: CredUI_Prompt_Called

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Prompt_Called

Event ID 35002: CredUI_Dialog_CreatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Start

Event ID 35003: CredUI_Dialog_CreatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Stop

Event ID 35004: CredUI_UserList_TileEnumeration

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_UserList_TileEnumeration

Event ID 35005: CredUI_Dialog_Destroyed

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Destroyed

Event ID 35006: CredUI_Dialog_DUIInitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Start

Event ID 35007: CredUI_Dialog_DUIInitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Stop

Event ID 35008: CredUI_Dialog_LoadStyleSheetStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Start

Event ID 35009: CredUI_Dialog_LoadStyleSheetStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Stop

Event ID 35010: CredUI_ModernDialog_CreatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Start

Event ID 35011: CredUI_ModernDialog_CreatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Stop

Event ID 35012: CredUI_ModernDialog_DUIInitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Start

Event ID 35013: CredUI_ModernDialog_DUIInitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Stop

Event ID 35014: CredUI_ModernDialog_LoadStyleSheetStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Start

Event ID 35015: CredUI_ModernDialog_LoadStyleSheetStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Stop

Event ID 35016: CredUI_EnumerationSyncStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_EnumerationSync
Opcode: Stop

Event ID 45001: Shutdown_ShutdownChoices_UserHasShutdownRightsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Start

Event ID 45002: Shutdown_ShutdownChoices_UserHasShutdownRightsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Stop

Event ID 45003: Shutdown_ShutdownFlyout_CreateAndShowStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Start

Event ID 45004: Shutdown_ShutdownFlyout_CreateAndShowStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Stop

Event ID 45005: Shutdown_ShutdownFlyout_PromptForReasonStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Start

Event ID 45006: Shutdown_ShutdownFlyout_PromptForReasonStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Stop

Event ID 45007: Shutdown_ShutdownFlyout_PromptForConfirmationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Start

Event ID 45008: Shutdown_ShutdownFlyout_PromptForConfirmationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Stop

Event ID 45009: Shutdown_ShutdownFlyout_InitiatePowerTransitionStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Start

Event ID 45010: Shutdown_ShutdownFlyout_InitiatePowerTransitionStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Stop

Event ID 45011: Shutdown_SlideToShutDownScreen_InitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Start

Event ID 45012: Shutdown_SlideToShutDownScreen_InitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Stop

Event ID 45013: Shutdown_SlideToShutDownScreen_ShowModalStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Start

Fields #

Name	Description
`Boolean1` Boolean

Event ID 45014: Shutdown_SlideToShutDownScreen_ShowModalStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Stop

Event ID 45015: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Start

Event ID 45016: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Stop

Event ID 45017: Shutdown_SlideToShutDownScreen_DismissStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Start

Event ID 45018: Shutdown_SlideToShutDownScreen_DismissStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Stop

Event ID 45019: Shutdown_SlideToShutDownScreen_Timeout

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Timeout

Event ID 55001: CredentialProviderUser_EnumerateLogonUsersStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Start

Event ID 55002: CredentialProviderUser_EnumerateLogonUsersStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Stop

Event ID 55003: CredentialProviderUser_EnumerateLastLoggedOnUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Start

Event ID 55004: CredentialProviderUser_EnumerateLastLoggedOnUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Stop

Event ID 55005: CredentialProviderUser_EnumerateAutoLogonUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Start

Event ID 55006: CredentialProviderUser_EnumerateAutoLogonUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Stop

Event ID 55007: CredentialProviderUser_EnumerateInSessionUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Start

Event ID 55008: CredentialProviderUser_EnumerateInSessionUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Stop

Event ID 55009: CredentialProviderUser_EnumerateLocalAdminsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Start

Event ID 55010: CredentialProviderUser_EnumerateLocalAdminsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Stop

Event ID 55011: CredentialProviderUser_Init_CredentialProviderUserArrayStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Start

Event ID 55012: CredentialProviderUser_Init_CredentialProviderUserArrayStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Stop

Event ID 55013: CredentialProviderUser_CloneUserArray

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_CloneUserArray

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 55014: CredentialProviderUser_SetProviderFilter

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_SetProviderFilter

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 55015: CredentialProviderUser_GetAccountOptions

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_GetAccountOptions

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61001: PicturePassword_LaunchEnrollmentUX

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_LaunchEnrollmentUX

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61002: PicturePassword_EnrollmentUXTeachingShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXTeachingShown

Event ID 61003: PicturePassword_EnrollmentUXImageConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXImageConfirmationShown

Event ID 61004: PicturePassword_EnrollmentUXRelearnShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXRelearnShown

Event ID 61005: PicturePassword_EnrollmentUXGestureEntryShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureEntryShown

Event ID 61006: PicturePassword_EnrollmentUXGestureConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureConfirmationShown

Event ID 61007: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Event ID 61008: PicturePassword_EnrollmentUXErrorShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXErrorShown

Event ID 61009: PicturePassword_RenderFeedbackStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Start

Event ID 61010: PicturePassword_RenderFeedbackStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61011: PicturePassword_FeedbackVisibleStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Start

Event ID 61012: PicturePassword_FeedbackVisibleStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Stop

Event ID 61013: PicturePassword_SubmitEnrollmentToSystemStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Start

Event ID 61014: PicturePassword_SubmitEnrollmentToSystemStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61015: PicturePassword_SanitizeImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Start

Event ID 61016: PicturePassword_SanitizeImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61017: PicturePassword_EnrollmentHandlerCreate

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerCreate

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61018: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Start

Event ID 61019: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61020: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Start

Event ID 61021: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61022: PicturePassword_EnrollmentHandlerSetEnrollmentStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Start

Event ID 61023: PicturePassword_EnrollmentHandlerSetEnrollmentStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61024: PicturePassword_EnrollmentHandlerClearEnrollmentStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Start

Event ID 61025: PicturePassword_EnrollmentHandlerClearEnrollmentStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61026: PicturePassword_CredentialCreate

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialCreate

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61027: PicturePassword_CredentialSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSelected

Event ID 61028: PicturePassword_CredentialDeselected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialDeselected

Event ID 61029: PicturePassword_CredentialSetSubmitData

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSetSubmitData

Event ID 61030: PicturePassword_CredentialGetSerializationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Start

Event ID 61031: PicturePassword_CredentialGetSerializationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61032: PicturePassword_SyncedImageLoadingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Start

Event ID 61033: PicturePassword_SyncedImageLoadingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61034: PicturePassword_EnrollmentImageSavingForRoamingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Start

Event ID 61035: PicturePassword_EnrollmentImageSavingForRoamingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61036: PicturePassword_SyncedImageSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageSelected

Event ID 61037: PicturePassword_CheckRoamingImageAvailable

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CheckRoamingImageAvailable

Fields #

Name	Description
`DWORD1` UInt32

Event ID 64001: LockScreenCall_AcceptCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64002: LockScreenCall_AcceptCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64003: LockScreenCall_QueueCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64004: LockScreenCall_QueueCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64005: LockScreenCall_StartCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID
`message1` UnicodeString
`message2` UnicodeString

Event ID 64006: LockScreenCall_StartCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64007: LockScreenCall_EndCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64008: LockScreenCall_EndCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64009: LockScreenCall_EvictCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64010: LockScreenCall_EvictCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64501: LockScreenCallBroker_StartCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID
`message1` UnicodeString
`message2` UnicodeString

Event ID 64502: LockScreenCallBroker_StartCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64503: LockScreenCallBroker_EndCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64504: LockScreenCallBroker_EndCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64505: LockScreenCallBroker_OnUnlockingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64506: LockScreenCallBroker_OnUnlockingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64507: LockScreenCallBroker_EventSignaled

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EventSignaled

Fields #

Name	Description
`guid` GUID

Event ID 64508: LockScreenCallBroker_HostExited

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_HostExited

Fields #

Name	Description
`guid` GUID

Event ID 64509: LockScreenCallBroker_AccessibleNameChanged

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AccessibleNameChanged

Fields #

Name	Description
`guid` GUID
`message` UnicodeString

Event ID 64510: LockScreenCallBroker_AppExited

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AppExited

Fields #

Name	Description
`guid` GUID

Event ID 65001: Booting_Animation_DoPearlSyncStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Start

Event ID 65002: Booting_Animation_DoPearlSyncStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Stop

Event ID 65003: Booting_Animation_InitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Start

Event ID 65004: Booting_Animation_InitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Stop

Event ID 65005: Booting_Animation_TimerProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Start

Event ID 65006: Booting_Animation_TimerProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Stop

Event ID 65007: Booting_Animation_LoadImgStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Start

Event ID 65008: Booting_Animation_LoadImgStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Stop

Event ID 65009: Booting_Animation_AnimationCompleteProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Start

Event ID 65010: Booting_Animation_AnimationCompleteProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Stop

Event ID 65011: Booting_Animation_AnimCallbackObjLifetimeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Start

Event ID 65012: Booting_Animation_AnimCallbackObjLifetimeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Stop

Event ID 65013: Booting_Animation_PlaySoundThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Start

Event ID 65014: Booting_Animation_PlaySoundThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Stop

Event ID 65015: Booting_Animation_InitAudioThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Start

Event ID 65016: Booting_Animation_InitAudioThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Stop

Event ID 65017: Booting_Animation_AttachToMMCSSStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Start

Event ID 65018: Booting_Animation_AttachToMMCSSStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Stop

Event ID 65019: Logon_LogonFrame_InitializeInputIndicatorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Start

Event ID 65020: Logon_LogonFrame_InitializeInputIndicatorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Stop

Event ID 65030: LockscreenNotifications_NotificationUpdatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString

Event ID 65031: LockscreenNotifications_NotificationUpdatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Stop

Event ID 65032: LockscreenNotifications_NotificationArrivedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString

Event ID 65033: LockscreenNotifications_NotificationArrivedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 63d2bb1d-e39a-41b8-9a3d-52dd06677588

Defined in credprovhost.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Shell-AuthUI registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Shell-AuthUI registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)