Microsoft-Windows-Shell-AuthUI

291 events across 8 channels

Event ID	Title	Channel
5001	Logon user interface creation failed.	Operational
5002	Logon user interface RPC server startup failed.	Operational
5003	The username/password credential provider failed to enumerate tiles.	Operational
5004	Autologon failed.	Operational
5005	The autologon password could not be loaded.	Operational
5006	The autologon password could not be loaded.	Operational
5007	The OEM background could not be loaded for resolution DWORD1 x DWORD2.	Operational
5008	The OEM background Error was loaded but its aspect ratio does not match the …	Operational
5009	The OEM background Error was not loaded because the file is larger than DWORD1 …	Operational
5010	The credential provider thread creation failed.	Operational
5011	User enumeration failed.	Operational
5012	The first run task for package PackageFullName exceeded the maximum runtime …	Operational
5013	The autologon setting has been removed because AutoLogonSettingRemovalReason.	Operational
15001		Diagnostic
15002		Diagnostic
15003		Diagnostic
15004		Diagnostic
15005		Diagnostic
15006		Diagnostic
15007		Diagnostic
15008		Diagnostic
15009		Diagnostic
15010		Diagnostic
15011		Diagnostic
15012		Diagnostic
15013		Diagnostic
15014		Diagnostic
15015		Diagnostic
15016		Diagnostic
15017		Diagnostic
15018		Diagnostic
15019		Diagnostic
15020		Diagnostic
15021		Diagnostic
15022		Diagnostic
15023		Diagnostic
15024		Diagnostic
15025		Diagnostic
15026		Diagnostic
15027		Diagnostic
15028		Diagnostic
15029		Diagnostic
15030		Diagnostic
15031		Diagnostic
15032		Diagnostic
15033		Diagnostic
15034		Diagnostic
15035		Diagnostic
15036		Diagnostic
25001		Diagnostic
25002		Diagnostic
25003		Diagnostic
25004		Diagnostic
25005		Diagnostic
25006		Diagnostic
25007		Diagnostic
25008		Diagnostic
25009		Diagnostic
25010		Diagnostic
25011		Diagnostic
25012		Diagnostic
25013		Diagnostic
25014		Diagnostic
25015		Diagnostic
25016		Diagnostic
25017		Diagnostic
25018		Diagnostic
25019		Diagnostic
25020		Diagnostic
25021		Diagnostic
25022		Diagnostic
25023		Diagnostic
25024		Diagnostic
25025		Diagnostic
25026		Diagnostic
25027		Diagnostic
25028		Diagnostic
25029		Diagnostic
25030		Diagnostic
25031		Diagnostic
25032		Diagnostic
25033		Diagnostic
25034		Diagnostic
25035		Diagnostic
25036		Diagnostic
25037		Diagnostic
25038		Diagnostic
25039		Diagnostic
25040		Diagnostic
25041		Diagnostic
25042		Diagnostic
25043		Diagnostic
25044		Diagnostic
25047		Diagnostic
25048		Diagnostic
25049		Diagnostic
25050		Diagnostic
25051		Diagnostic
25052		Diagnostic
25053		Diagnostic
25054		Diagnostic
25055		Diagnostic
25056		Diagnostic
25057		Diagnostic
25058		Diagnostic
25059		Diagnostic
25060		Diagnostic
25061		Diagnostic
25062		Diagnostic
25063		Diagnostic
25064		Diagnostic
25065		Diagnostic
25066		Diagnostic
25068		Diagnostic
25072		Diagnostic
25073		Diagnostic
25074		Diagnostic
25075		Diagnostic
25076		Diagnostic
25077		Diagnostic
25078		Diagnostic
25079		Diagnostic
25080		Diagnostic
25082		Diagnostic
25083		Diagnostic
25084		Diagnostic
25085		Diagnostic
25087		Diagnostic
25088		Diagnostic
25089		Diagnostic
25090		Diagnostic
25091		Diagnostic
25093		Diagnostic
25094		Diagnostic
25095		Diagnostic
25096		Diagnostic
25097		Diagnostic
25098		Diagnostic
25099		Diagnostic
25100		Diagnostic
25101		Diagnostic
25102		Diagnostic
25103		Diagnostic
25104		Diagnostic
25105		Diagnostic
25106		Diagnostic
25107		Diagnostic
25108		Diagnostic
25109		Diagnostic
25110		Diagnostic
25111		Diagnostic
25112		Diagnostic
25113		Diagnostic
25114		Diagnostic
25115		Diagnostic
25116		Diagnostic
25117		Diagnostic
25118		Diagnostic
25119		Diagnostic
25120		Diagnostic
35001		Diagnostic
35002		Diagnostic
35003		Diagnostic
35004		Diagnostic
35005		Diagnostic
35006		Diagnostic
35007		Diagnostic
35008		Diagnostic
35009		Diagnostic
35010		Diagnostic
35011		Diagnostic
35012		Diagnostic
35013		Diagnostic
35014		Diagnostic
35015		Diagnostic
35016		Diagnostic
45001		Diagnostic
45002		Diagnostic
45003		Diagnostic
45004		Diagnostic
45005		Diagnostic
45006		Diagnostic
45007		Diagnostic
45008		Diagnostic
45009		Diagnostic
45010		Diagnostic
45011		Diagnostic
45012		Diagnostic
45013		Diagnostic
45014		Diagnostic
45015		Diagnostic
45016		Diagnostic
45017		Diagnostic
45018		Diagnostic
45019		Diagnostic
55001		Diagnostic
55002		Diagnostic
55003		Diagnostic
55004		Diagnostic
55005		Diagnostic
55006		Diagnostic
55007		Diagnostic
55008		Diagnostic
55009		Diagnostic
55010		Diagnostic
55011		Diagnostic
55012		Diagnostic
55013		Diagnostic
55014		Diagnostic
55015		Diagnostic
61001		Diagnostic
61002		Diagnostic
61003		Diagnostic
61004		Diagnostic
61005		Diagnostic
61006		Diagnostic
61007		Diagnostic
61008		Diagnostic
61009		Diagnostic
61010		Diagnostic
61011		Diagnostic
61012		Diagnostic
61013		Diagnostic
61014		Diagnostic
61015		Diagnostic
61016		Diagnostic
61017		Diagnostic
61018		Diagnostic
61019		Diagnostic
61020		Diagnostic
61021		Diagnostic
61022		Diagnostic
61023		Diagnostic
61024		Diagnostic
61025		Diagnostic
61026		Diagnostic
61027		Diagnostic
61028		Diagnostic
61029		Diagnostic
61030		Diagnostic
61031		Diagnostic
61032		Diagnostic
61033		Diagnostic
61034		Diagnostic
61035		Diagnostic
61036		Diagnostic
61037		Diagnostic
64001		Diagnostic
64002		Diagnostic
64003		Diagnostic
64004		Diagnostic
64005		Diagnostic
64006		Diagnostic
64007		Diagnostic
64008		Diagnostic
64009		Diagnostic
64010		Diagnostic
64501		Diagnostic
64502		Diagnostic
64503		Diagnostic
64504		Diagnostic
64505		Diagnostic
64506		Diagnostic
64507		Diagnostic
64508		Diagnostic
64509		Diagnostic
64510		Diagnostic
65001		Diagnostic
65002		Diagnostic
65003		Diagnostic
65004		Diagnostic
65005		Diagnostic
65006		Diagnostic
65007		Diagnostic
65008		Diagnostic
65009		Diagnostic
65010		Diagnostic
65011		Diagnostic
65012		Diagnostic
65013		Diagnostic
65014		Diagnostic
65015		Diagnostic
65016		Diagnostic
65017		Diagnostic
65018		Diagnostic
65019		Diagnostic
65020		Diagnostic
65030		Diagnostic
65031		Diagnostic
65032		Diagnostic
65033		Diagnostic

Event ID 5001 — Logon user interface creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface creation failed. Details: Error.

Message #

Logon user interface creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5002 — Logon user interface RPC server startup failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface RPC server startup failed. Details: Error.

Message #

Logon user interface RPC server startup failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5003 — The username/password credential provider failed to enumerate tiles.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The username/password credential provider failed to enumerate tiles.

Message #

The username/password credential provider failed to enumerate tiles.

Event ID 5004 — Autologon failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Autologon failed. Details: Error.

Message #

Autologon failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5005 — The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded.

Message #

The autologon password could not be loaded.

Event ID 5006 — The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded. Details: Error.

Message #

The autologon password could not be loaded.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5007 — The OEM background could not be loaded for resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background could not be loaded for resolution DWORD1 x DWORD2. Details: Error.

Message #

The OEM background could not be loaded for resolution %2 x %3.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 5008 — The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Message #

The OEM background %1 was loaded but its aspect ratio does not match the primary display resolution %2 x %3.

Fields #

Name	Description
`Error` UnicodeString	—
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 5009 — The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Message #

The OEM background %1 was not loaded because the file is larger than %2 bytes.

Fields #

Name	Description
`Error` UnicodeString	—
`DWORD1` UInt32	—

Event ID 5010 — The credential provider thread creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The credential provider thread creation failed. Details: Error.

Message #

The credential provider thread creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5011 — User enumeration failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

User enumeration failed. Details: Error.

Message #

User enumeration failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString	—

Event ID 5012 — The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Message #

The first run task for package %1 exceeded the maximum runtime alotted and has been cancelled.

Fields #

Name	Description
`PackageFullName` UnicodeString	—

Event ID 5013 — The autologon setting has been removed because AutoLogonSettingRemovalReason.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon setting has been removed because AutoLogonSettingRemovalReason.

Message #

The autologon setting has been removed because %1.

Fields #

Name	Description
`AutoLogonSettingRemovalReason` UInt32	—

Event ID 15001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Start

Event ID 15002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Stop

Event ID 15003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Start

Event ID 15004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Stop

Event ID 15005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Start

Event ID 15006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Stop

Event ID 15007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Start

Event ID 15008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Stop

Event ID 15009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Start

Event ID 15010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Stop

Event ID 15011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Start

Event ID 15012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Stop

Event ID 15013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Tile_FireSubmitEvent

Event ID 15014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Start

Event ID 15015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Stop

Event ID 15016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_AddCredProvider

Fields #

Name	Description
`message1` UnicodeString	—

Event ID 15017 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Start

Event ID 15018 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 15019 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Start

Event ID 15020 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 15021 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Start

Event ID 15022 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Stop

Event ID 15023 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetUsageScenario

Fields #

Name	Description
`message1` UnicodeString	—
`DWORD1` UInt32	—

Event ID 15024 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSerialization

Fields #

Name	Description
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 15025 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialAt

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 15026 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialCount

Fields #

Name	Description
`message1` UnicodeString	—
`DWORD1` UInt32	—
`DWORD2` UInt32	—
`Boolean1` Boolean	—

Event ID 15027 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFieldDescriptorCount

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 15028 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Credential_GetUserSid

Fields #

Name	Description
`DWORD1` UInt32	—
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 15029 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSelected

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 15030 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetDeSelected

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 15031 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetSerialization

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 15032 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_ReportResult

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—
`DWORD3` UInt32	—

Event ID 15033 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Start

Event ID 15034 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Stop

Event ID 15035 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateEnumerationSyncReply

Event ID 15036 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_StartCredProvsForUsageScenario

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—

Event ID 25001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Start

Event ID 25002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Stop

Event ID 25003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Start

Event ID 25004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Stop

Event ID 25005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Start

Event ID 25006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Stop

Event ID 25007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Start

Event ID 25008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Stop

Event ID 25009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Start

Event ID 25010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Stop

Event ID 25011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Start

Event ID 25012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Stop

Event ID 25013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Start

Event ID 25014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Stop

Event ID 25015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Start

Event ID 25016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Stop

Event ID 25017 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Start

Event ID 25018 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Stop

Event ID 25019 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Start

Event ID 25020 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Stop

Event ID 25021 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Start

Event ID 25022 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Stop

Event ID 25023 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Start

Event ID 25024 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Stop

Event ID 25025 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Start

Event ID 25026 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Stop

Event ID 25027 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Start

Event ID 25028 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Stop

Event ID 25029 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Start

Event ID 25030 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Stop

Event ID 25031 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Start

Event ID 25032 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Stop

Event ID 25033 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Start

Event ID 25034 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Stop

Event ID 25035 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Start

Event ID 25036 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Stop

Event ID 25037 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Start

Event ID 25038 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Stop

Event ID 25039 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Start

Event ID 25040 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Stop

Event ID 25041 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Start

Event ID 25042 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Stop

Event ID 25043 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Start

Event ID 25044 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Stop

Event ID 25047 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Start

Event ID 25048 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Stop

Event ID 25049 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Start

Event ID 25050 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Stop

Event ID 25051 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Start

Event ID 25052 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Fields #

Name	Description
`Boolean1` Boolean	—

Event ID 25053 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsLocalNoPasswordUser
Opcode: Start

Event ID 25054 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Event ID 25055 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Start

Event ID 25056 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Stop

Event ID 25057 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Start

Event ID 25058 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32	—

Event ID 25059 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Start

Event ID 25060 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Stop

Event ID 25061 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Start

Event ID 25062 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32	—

Event ID 25063 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Start

Event ID 25064 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Stop

Event ID 25065 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_UserSwitching
Opcode: Stop

Event ID 25066 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToCancelAfterEnumerate
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32	—

Event ID 25068 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToCancelAfterResume
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32	—

Event ID 25072 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Start

Event ID 25073 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Fields #

Name	Description
`UserType` UInt32	—
`CredProvCount` UInt32	—
`IsLogonScenario` UInt32	—
`IsFirstLogon` UInt32	—

Event ID 25074 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetSerializationReply

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25075 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnProviderCredentialsChanged

Fields #

Name	Description
`Boolean1` Boolean	—

Event ID 25076 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayStatusMessage

Fields #

Name	Description
`message1` UnicodeString	—

Event ID 25077 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_LogonDialogCallback

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25078 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayLogonDialog

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25079 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_GetBackgroundForUser

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25080 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_ShowUserBackground

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25082 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Start

Event ID 25083 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Stop

Event ID 25084 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_QueryAutoLogon_Info

Fields #

Name	Description
`DWORD1` UInt32	—
`DWORD2` UInt32	—
`DWORD3` UInt32	—
`DWORD4` UInt32	—
`DWORD5` UInt32	—

Event ID 25085 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IgnoreAutoLogonMode_Info

Event ID 25087 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Start

Event ID 25088 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Stop

Event ID 25089 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Shown

Event ID 25090 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString	—
`DWORD1` UInt32	—

Event ID 25091 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Stop

Event ID 25093 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Start

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 25094 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Stop

Event ID 25095 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Event ID 25096 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_Lock
Opcode: Stop

Event ID 25097 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Start

Event ID 25098 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Stop

Event ID 25099 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Start

Event ID 25100 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Stop

Fields #

Name	Description
`OutstandingTasks` UInt32	—
`TasksCancelled` UInt32	—

Event ID 25101 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks

Fields #

Name	Description
`PackageFullName` UnicodeString	—

Event ID 25102 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Start

Event ID 25103 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Stop

Event ID 25104 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Start

Event ID 25105 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Stop

Event ID 25106 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Start

Event ID 25107 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Stop

Event ID 25108 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Start

Event ID 25109 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Stop

Event ID 25110 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Start

Event ID 25111 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Stop

Event ID 25112 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock

Event ID 25113 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Start

Fields #

Name	Description
`InvokeObject` UInt32	—

Event ID 25114 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Stop

Fields #

Name	Description
`Result` UInt32	—

Event ID 25115 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Start

Event ID 25116 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Stop

Fields #

Name	Description
`Result` UInt32	—

Event ID 25117 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Start

Event ID 25118 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Stop

Event ID 25119 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Start

Event ID 25120 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Stop

Event ID 35001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Prompt_Called

Event ID 35002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Start

Event ID 35003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Stop

Event ID 35004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_UserList_TileEnumeration

Event ID 35005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Destroyed

Event ID 35006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Start

Event ID 35007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Stop

Event ID 35008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Start

Event ID 35009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Stop

Event ID 35010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Start

Event ID 35011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Stop

Event ID 35012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Start

Event ID 35013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Stop

Event ID 35014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Start

Event ID 35015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Stop

Event ID 35016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_EnumerationSync
Opcode: Stop

Event ID 45001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Start

Event ID 45002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Stop

Event ID 45003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Start

Event ID 45004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Stop

Event ID 45005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Start

Event ID 45006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Stop

Event ID 45007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Start

Event ID 45008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Stop

Event ID 45009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Start

Event ID 45010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Stop

Event ID 45011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Start

Event ID 45012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Stop

Event ID 45013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Start

Fields #

Name	Description
`Boolean1` Boolean	—

Event ID 45014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Stop

Event ID 45015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Start

Event ID 45016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Stop

Event ID 45017 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Start

Event ID 45018 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Stop

Event ID 45019 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Timeout

Event ID 55001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Start

Event ID 55002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Stop

Event ID 55003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Start

Event ID 55004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Stop

Event ID 55005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Start

Event ID 55006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Stop

Event ID 55007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Start

Event ID 55008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Stop

Event ID 55009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Start

Event ID 55010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Stop

Event ID 55011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Start

Event ID 55012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Stop

Event ID 55013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_CloneUserArray

Fields #

Name	Description
`Error` UnicodeString	—
`DWORD1` UInt32	—

Event ID 55014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_SetProviderFilter

Fields #

Name	Description
`Error` UnicodeString	—
`DWORD1` UInt32	—

Event ID 55015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_GetAccountOptions

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_LaunchEnrollmentUX

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXTeachingShown

Event ID 61003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXImageConfirmationShown

Event ID 61004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXRelearnShown

Event ID 61005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureEntryShown

Event ID 61006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureConfirmationShown

Event ID 61007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Event ID 61008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXErrorShown

Event ID 61009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Start

Event ID 61010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Start

Event ID 61012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Stop

Event ID 61013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Start

Event ID 61014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Start

Event ID 61016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61017 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerCreate

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61018 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Start

Event ID 61019 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61020 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Start

Event ID 61021 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61022 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Start

Event ID 61023 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61024 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Start

Event ID 61025 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61026 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialCreate

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61027 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSelected

Event ID 61028 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialDeselected

Event ID 61029 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSetSubmitData

Event ID 61030 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Start

Event ID 61031 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61032 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Start

Event ID 61033 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61034 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Start

Event ID 61035 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 61036 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageSelected

Event ID 61037 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CheckRoamingImageAvailable

Fields #

Name	Description
`DWORD1` UInt32	—

Event ID 64001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 64002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 64004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID	—
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 64006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID	—

Event ID 64008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Start

Fields #

Name	Description
`guid` GUID	—

Event ID 64010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64501 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID	—
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 64502 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64503 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID	—

Event ID 64504 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64505 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString	—
`message2` UnicodeString	—

Event ID 64506 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32	—

Event ID 64507 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EventSignaled

Fields #

Name	Description
`guid` GUID	—

Event ID 64508 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_HostExited

Fields #

Name	Description
`guid` GUID	—

Event ID 64509 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AccessibleNameChanged

Fields #

Name	Description
`guid` GUID	—
`message` UnicodeString	—

Event ID 64510 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AppExited

Fields #

Name	Description
`guid` GUID	—

Event ID 65001 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Start

Event ID 65002 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Stop

Event ID 65003 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Start

Event ID 65004 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Stop

Event ID 65005 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Start

Event ID 65006 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Stop

Event ID 65007 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Start

Event ID 65008 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Stop

Event ID 65009 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Start

Event ID 65010 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Stop

Event ID 65011 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Start

Event ID 65012 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Stop

Event ID 65013 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Start

Event ID 65014 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Stop

Event ID 65015 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Start

Event ID 65016 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Stop

Event ID 65017 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Start

Event ID 65018 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Stop

Event ID 65019 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Start

Event ID 65020 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Stop

Event ID 65030 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32	—
`Operation` UInt32	— Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString	—

Event ID 65031 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Stop

Event ID 65032 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32	—
`Operation` UInt32	— Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString	—

Event ID 65033 —

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Stop