Microsoft-Windows-AAD

Event	Title	Channel	Sample	Rule
1001	AadCloudAPPlugin Initialize Start	Analytic	N	N
1002	AadCloudAPPlugin Initialize Stop.	Analytic	N	N
1003	AadCloudAPPlugin Uninitialize Start	Analytic	N	N
1004	AadCloudAPPlugin ValidateUserInfo Start	Analytic	N	N
1005	AadCloudAPPlugin ValidateUserInfo Stop.	Analytic	N	N
1006	AadCloudAPPlugin GetToken Start	Analytic	N	N
1007	AadCloudAPPlugin GetToken Stop.	Analytic	N	N
1008	AadCloudAPPlugin GetKeys Start	Analytic	N	N
1009	AadCloudAPPlugin GetKeys Stop.	Analytic	N	N
1010	AadCloudAPPlugin GetUnlockKey Start	Analytic	N	N
1011	AadCloudAPPlugin GetUnlockKey Stop.	Analytic	N	N
1012	AadCloudAPPlugin PersistSSOTokens Start	Analytic	N	N
1013	AadCloudAPPlugin PersistSSOTokens Stop.	Analytic	N	N
1015	AadCloudAPPlugin Realm discovery response: …	Analytic	N	N
1016	AadCloudAPPlugin device is cloud domain joined	Analytic	N	N
1017	AadCloudAPPlugin device is domain joined	Analytic	N	N
1018	AadCloudAPPlugin GetToken Correlation ID: …	Analytic	N	N
1019	AadCloudAPPlugin GetKeys Correlation ID: …	Analytic	N	N
1020	AadCloudAPPlugin loaded as surrogate	Analytic	N	N
1021	AadCloudAPPlugin MEX request status: AadCloudAPPlugin_MEX_request_status.	Analytic	N	N
1022	Endpoint Uri: Endpoint_Uri.	Analytic	N	N
1023	NGC UserID Key: NGC_UserID_Key.	Analytic	N	N
1024	Http request status: Http_request_status.	Operational	N	N
1025	Http request status: Http_request_status.	Operational	N	N
1026	Credential type: Credential_type Correlation ID: Correlation_ID.	Analytic	N	N
1027	AadCloudAPPlugin managed logon flow for federated NGC user.	Analytic	N	N
1028	AadCloudAPPlugin RefreshToken Start	Analytic	N	N
1029	AadCloudAPPlugin RefreshToken Stop.	Analytic	N	N
1030	AadCloudAPPlugin RefreshToken Correlation ID: …	Analytic	N	N
1031	AadCloudAPPlugin encrypted OAuth response received	Analytic	N	N
1032	Number of groups received: value.	Analytic	N	N
1033	Validation needed: Validation_needed.	Analytic	N	N
1034	AadCloudAPPlugin GenericCallPkg Start	Analytic	N	N
1035	AadCloudAPPlugin GenericCallPkg Stop.	Analytic	N	N
1081	OAuth response error: OAuth_response_error.	Operational	N	N
1082	Key error: Key_error.	Operational	N	N
1083	Protected key error: Protected_key_error.	Operational	N	N
1084	Http transport error.	Operational	N	N
1085	Logon failure.	Operational	N	N
1086	Get user realm failure.	Operational	N	N
1087	Get credential keys failure.	Operational	N	N
1088	WSTrust response error: WSTrust_response_error.	Operational	N	N
1089	Device is not cloud domain joined: Status.	Operational	N	N
1090	NGC nonce response error: NGC_nonce_response_error.	Operational	N	N
1091	NGC auth ticket is not defined.	Operational	N	N
1092	OAuth request retry.	Operational	N	N
1093	NGC call API returned error: Result.	Operational	N	N
1094	Refresh token failure.	Operational	N	N
1095	Refresh token user SIDs don't match.	Operational	N	N
1096	Refresh token is expired.	Operational	N	N
1097	Error: Error ErrorMessage AdditionalInformation.	Operational	Y	N
1098	Error: Error ErrorMessage AdditionalInformation.	Operational	Y	N
1099	Code: Code OperationCode OperationMessage.	Analytic	N	N
1100	Error: Error ErrorMessage AdditionalInformation.	Operational	N	N
1101	Error: Error ErrorMessage AdditionalInformation.	Operational	N	N
1102	Code: Code OperationCode OperationMessage.	Analytic	N	N
1103	Can't decrypt OAuth response.	Operational	N	N
1104	AAD Cloud AP plugin call API returned error: Result.	Operational	Y	N
1105	Device registration API call API returned error: Result.	Operational	N	N
1106	Number of security groups received value.	Operational	N	N
1107	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1108	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1109	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1110	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1111	Error: Error ErrorMessage AdditionalInformation.	Operational	N	N
1112	Error: Error ErrorMessage AdditionalInformation.	Operational	N	N
1113	Code: Code OperationCode OperationMessage.	Analytic	N	N
1114	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1115	Error: Error ErrorMessage AdditionalInformation.	Analytic	N	N
1116	Get Enterprise STS OAuth Info failure.	Operational	N	N
1117	Enterprise STS Refresh token failure.	Operational	N	N
1118	Enterprise STS Logon failure.	Operational	N	N
1119	Enterprise STS OAuth Info response: Enterprise_STS_OAuth_Info_response.	Analytic	N	N
1120	Enterprise STS Refresh token is expired.	Operational	N	N
1121	Enterprise STS RefreshToken Correlation ID: value.	Analytic	N	N
1122	Refresh token subject don't match.	Operational	N	N
1123	AadCloudAPPlugin smart card logon for non-federated user.	Operational	N	N
1124	Device is DRS joined but Enterprise STS is disabled: Status.	Operational	N	N
1125	AadCloudAPPlugin loaded as surrogate, no key recovery	Analytic	N	N
1126	AadCloudAPPlugin device is Enterprise joined	Analytic	N	N
1127	AadCloudAPPlugin device P2P certificate update thread started	Analytic	N	N
1128	AadCloudAPPlugin device P2P certificate update thread stopped	Analytic	N	N
1129	AadCloudAPPlugin Uninitialize Stop	Analytic	N	N
1130	AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: …	Analytic	N	N
1131	Update P2P device certificate failure.	Operational	N	N
1132	AadCloudAPPlugin GetCertificateFromCred Correlation ID: …	Analytic	N	N
1133	Update P2P user certificate failure.	Operational	N	N
1134	AAD Cloud AP plugin call API returned error: Result.	Analytic	N	N
1135	AadCloudAPPlugin RenewCertificate Correlation ID: …	Analytic	N	N
1136	AadCloudAPPlugin AcceptPeerCertificate Start	Analytic	N	N
1137	AadCloudAPPlugin AcceptPeerCertificate Stop.	Analytic	N	N
1138	AadCloudAPPlugin RenewCertificate Start	Analytic	N	N
1139	AadCloudAPPlugin RenewCertificate Stop.	Analytic	N	N
1140	AadCloudAPPlugin GetCertificateFromCred Start	Analytic	N	N
1141	AadCloudAPPlugin GetCertificateFromCred Stop.	Analytic	N	N
1142	Get token user names don't match.	Operational	N	N
1143	Generic Call Package call type: Generic_Call_Packate_call_type.	Analytic	N	N
1144	Realm discovery for: Method authority: EndpointUri fallback domain hint: …	Analytic	N	N
1145	AAD Cloud AP plugin token needs refresh reason: value.	Analytic	N	N
1146	Token is not refreshed.	Analytic	N	N
1147	AadCloudAPPlugin AssembleOpaqueData Start	Analytic	N	N
1148	AadCloudAPPlugin AssembleOpaqueData Stop.	Analytic	N	N
1149	AadCloudAPPlugin DisassembleOpaqueData Start	Analytic	N	N
1150	AadCloudAPPlugin DisassembleOpaqueData Stop.	Analytic	N	N
1151	AadCloudAPPlugin P2P device certificate update error: Status.	Operational	N	N
1152	AadCloudAPPlugin device certificate key error: Result.	Operational	N	N
1153	AadCloudAPPlugin device certificate not available for logon: value.	Operational	N	N
1154	Password expiration claims.	Analytic	N	N
1155	Logon with session key failure.	Operational	N	N
1156	Password expiration fields.	Analytic	N	N
1157	AadCloudAPPlugin PostLogonProcessing Start	Analytic	N	N
1158	AadCloudAPPlugin PostLogonProcessing Stop.	Analytic	N	N
1159	AadCloudAPPlugin S4U logon failed.	Operational	N	N
1160	Logon failure.	Operational	N	N
1161	Logon failure.	Operational	N	N
1162	Logon failure.	Operational	N	N
1163	Logon failure.	Operational	N	N
1164	Logon failure.	Operational	N	N
1165	Logon failure.	Operational	N	N
1200	BrowserCore operation started	Analytic	N	N
1201	BrowserCore operation completed successfully	Analytic	N	N
1202	BrowserCore operation completed with a failure.	Operational	N	N
1203	BrowserCore inner operation FunctionName completed with error: Result.	Operational	N	N
1204	AadCloudAPPlugin LookupSIDFromIdentityName Start	Analytic	N	N
1205	AadCloudAPPlugin LookupSIDFromIdentityName Stop.	Analytic	N	N
1206	AadCloudAPPlugin LookupIdentityFromSIDName Start	Analytic	N	N
1207	AadCloudAPPlugin LookupIdentityFromSIDName Stop.	Analytic	N	N
1208	AadCloudAPPlugin LookupSIDFromIdentity Identity: …	Analytic	N	N
1209	AadCloudAPPlugin LookupIdentityFromSID SID: …	Analytic	N	N
1210	AadCloudAPPlugin password expired, password change URI: value.	Operational	N	N
1211	Writing RunRecovery registry value failed.	Operational	N	N
1212	Enterprise logon.	Operational	N	N
1213	WamExtension process token operation started	Analytic	N	N
1214	WamExtension process token operation completed successfully	Analytic	N	N
1215	WamExtension process token operation completed with error: Data.	Operational	Y	N
1216	WamExtension device authentication call status: Result Correlation ID: Target.	Analytic	N	N
1217	Get device token.	Analytic	N	N
1218	StartFidoAuthenticationSession start	Analytic	N	N
1219	StartFidoAuthenticationSession stop.	Analytic	N	N
1220	CloseFidoAuthenticationSession start	Analytic	N	N
1221	CloseFidoAuthenticationSession stop.	Analytic	N	N
1222	GetClientData start	Analytic	N	N
1223	GetClientData stop.	Analytic	N	N
1224	SignClientDataFido start	Analytic	N	N
1225	SignClientDataFido stop.	Analytic	N	N
1226	ChangePin start	Analytic	N	N
1227	ChangePin stop.	Analytic	N	N
1228	GetSerializedAuthBuffer start	Analytic	N	N
1229	GetSerializedAuthBuffer stop.	Analytic	N	N
1230	AuthHelper call API returned error: Result.	Operational	N	N
1231	AadCloudAPPlugin Resource infomation: AadCloudAPPlugin_Resource_infomation.	Analytic	N	N
1232	AadCloudAPPlugin RBAC authorization code response: Response.	Analytic	N	N
1233	AadCloudAPPlugin User access control role: value.	Analytic	N	N
1234	AadCloudAPPlugin using resource id from the Idtoken: value.	Analytic	N	N
1235	RBAC Status: RBAC_Status Correlation ID: Correlation_ID.	Analytic	N	N
1236	Failed to create the resource id	Analytic	N	N
1237	Device is configured for RBAC authorization	Operational	N	N
1238	Not sending the client certificate as it is optional on the server	Analytic	N	N
1239	Doing RBAC logon of the device type: value.	Analytic	N	N
1240	Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate	Analytic	N	N
1241	On-prem tgt error: Onprem_tgt_error.	Operational	N	N
1242	Added user to admins security group	Analytic	N	N
1243	Removed user from admins security group	Analytic	N	N
1244	Security groups were not loaded.	Operational	N	N
1245	Security groups were not updated.	Operational	N	N
1246	User sid: User_sid Group sids: Group_sids.	Analytic	N	N
1247	RunRecovery registry value (Context) successfully written.	Operational	N	N
1248	AuthHelper auth buff local nonce	Operational	N	N
1249	Cloud tgt error: Cloud_tgt_error.	Operational	N	N
1250	DoGetToken Diagnostic Event.	Operational	N	N
1251	DoGetEnterpriseToken Diagnostic Event.	Operational	N	N
1252	DoRefreshToken Diagnostic Event.	Operational	N	N
1253	DoRefreshEnterpriseToken Diagnostic Event.	Operational	N	N
1254	Response content type: Response_content_type.	Analytic	N	N
1255	AD TGT: AD_TGT Cloud TGT: Cloud_TGT.	Analytic	N	N
1256	P2P certificate update error.	Operational	N	N
1257	Credbuffer correlation ID: Credbuffer_correlation_ID Correlation ID: …	Analytic	N	N
1258	CA cert hash (keyID): CA_cert_hash_keyID Correlation ID: Correlation_ID.	Analytic	N	N
1259	CA certificate update error.	Operational	N	N
1260	RetryGetClientData start	Analytic	N	N
1261	RetryGetClientData stop.	Analytic	N	N
1262	Binding key tag check failed: Binding_key_tag_check_failed.	Operational	N	N
1263	BrowserCore inner operation FunctionName with account pairwiseID PairwiseID not …	Operational	N	N
1264	Token binding key created.	Analytic	N	N
1265	WamExtension preprocess token operation started.	Analytic	N	N
1266	WamExtension preprocess token operation completed successfully	Analytic	N	N
1267	WamExtension preprocess token operation completed with error: Result.	Operational	N	N
1268	WamExtension postprocess token operation started.	Analytic	N	N
1269	WamExtension postprocess token operation completed successfully.	Analytic	N	N
1270	WamExtension postprocess token operation completed with error: Result.	Operational	N	N
1271	Token binding claim(s) included in the request.	Analytic	N	N
1272	Token binding key is not healthy and needs to be re-created.	Analytic	N	N
1273	Token binding claims need to be re-generated due to changes in attestation …	Analytic	N	N
1274	Token binding claims generated.	Analytic	N	N
1275	Token binding claims generated for UI request.	Analytic	N	N
1276	Token binding claims count: ClaimsCount.	Analytic	N	N
1277	KeyGuard availability detection failed.	Operational	N	N
1278	KeyGuard with attestation support is not detected.	Operational	N	N
1279	Token binding claims of type KeyType could not be generated because AIK does not …	Analytic	N	N
1280	PRT session key needs to be rolled.	Operational	N	N
1281	Token binding key deleted.	Analytic	N	N
1282	SHR property in request is not allowed.	Operational	N	N
1283	Invalid registry value was ignored.	Analytic	N	N
1284	Token binding claims need to be re-generated as cached claims were generated for …	Analytic	N	N

Event ID 1001: AadCloudAPPlugin Initialize Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1002: AadCloudAPPlugin Initialize Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin Initialize Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1003: AadCloudAPPlugin Uninitialize Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1004: AadCloudAPPlugin ValidateUserInfo Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1005: AadCloudAPPlugin ValidateUserInfo Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin ValidateUserInfo Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1006: AadCloudAPPlugin GetToken Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1007: AadCloudAPPlugin GetToken Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin GetToken Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1008: AadCloudAPPlugin GetKeys Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1009: AadCloudAPPlugin GetKeys Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin GetKeys Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1010: AadCloudAPPlugin GetUnlockKey Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1011: AadCloudAPPlugin GetUnlockKey Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin GetUnlockKey Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1012: AadCloudAPPlugin PersistSSOTokens Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1013: AadCloudAPPlugin PersistSSOTokens Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin PersistSSOTokens Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1015: AadCloudAPPlugin Realm discovery response: AadCloudAPPlugin_Realm_discovery_response.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin Realm discovery response: %1.
Request status: %2

Fields #

Name	Description
`Response` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 1016: AadCloudAPPlugin device is cloud domain joined

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1017: AadCloudAPPlugin device is domain joined

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1018: AadCloudAPPlugin GetToken Correlation ID: AadCloudAPPlugin_GetToken_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin GetToken Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1019: AadCloudAPPlugin GetKeys Correlation ID: AadCloudAPPlugin_GetKeys_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin GetKeys Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1020: AadCloudAPPlugin loaded as surrogate

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1021: AadCloudAPPlugin MEX request status: AadCloudAPPlugin_MEX_request_status.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin MEX request status: %1

Fields #

Name	Description
`Status` Int32	NTSTATUS reference

Event ID 1022: Endpoint Uri: Endpoint_Uri.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

Endpoint Uri: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1023: NGC UserID Key: NGC_UserID_Key.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

NGC UserID Key: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1024: Http request status: Http_request_status.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Http request status: %1

Fields #

Name	Description
`value` Int32

Event ID 1025: Http request status: Http_request_status.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Http request status: Http_request_status. Method: Method Endpoint Uri: Endpoint_Uri Correlation ID: Correlation_ID.

Message #

Http request status: %1. Method: %2 Endpoint Uri: %3 Correlation ID: %4

Fields #

Name	Description
`value` Int32
`Method` UnicodeString
`EndpointUri` UnicodeString
`CorrelationID` UnicodeString

Event ID 1026: Credential type: Credential_type Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Credential type: %1 Correlation ID: %2

Fields #

Name	Description
`value` Int32
`CorrelationID` UnicodeString

Event ID 1027: AadCloudAPPlugin managed logon flow for federated NGC user.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1028: AadCloudAPPlugin RefreshToken Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1029: AadCloudAPPlugin RefreshToken Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin RefreshToken Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1030: AadCloudAPPlugin RefreshToken Correlation ID: AadCloudAPPlugin_RefreshToken_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin RefreshToken Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1031: AadCloudAPPlugin encrypted OAuth response received

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1032: Number of groups received: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Number of groups received: %1

Fields #

Name	Description
`value` Int32

Event ID 1033: Validation needed: Validation_needed.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Validation needed: %1

Fields #

Name	Description
`value` Int32

Event ID 1034: AadCloudAPPlugin GenericCallPkg Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1035: AadCloudAPPlugin GenericCallPkg Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin GenericCallPkg Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1081: OAuth response error: OAuth_response_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

OAuth response error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Error` UnicodeString
`ErrorDescription` UnicodeString
`CorrelationID` UnicodeString

Event ID 1082: Key error: Key_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Key error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Error` UnicodeString
`ErrorDescription` UnicodeString
`CorrelationID` UnicodeString

Event ID 1083: Protected key error: Protected_key_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Protected key error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Error` UnicodeString
`ErrorDescription` UnicodeString
`CorrelationID` UnicodeString

References #

Microsoft Learn

Event ID 1084: Http transport error.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Http transport error. Status: Http_transport_error_Status Correlation ID: Correlation_ID.

Message #

Http transport error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Result` Int32
`Target` UnicodeString

References #

Microsoft Learn

Event ID 1085: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1086: Get user realm failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get user realm failure. Status: Get_user_realm_failure_Status Correlation ID: Correlation_ID.

Message #

Get user realm failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1087: Get credential keys failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get credential keys failure. Status: Get_credential_keys_failure_Status Correlation ID: Correlation_ID.

Message #

Get credential keys failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1088: WSTrust response error: WSTrust_response_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

WSTrust response error: %1
Error description: %2

Fields #

Name	Description
`Error` UnicodeString
`ErrorDescription` UnicodeString

Event ID 1089: Device is not cloud domain joined: Status.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Device is not cloud domain joined: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1090: NGC nonce response error: NGC_nonce_response_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

NGC nonce response error: %1
Error description: %2
CorrelationID: %3

Fields #

Name	Description
`Error` UnicodeString
`ErrorDescription` UnicodeString
`CorrelationID` UnicodeString

Event ID 1091: NGC auth ticket is not defined.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

NGC auth ticket is not defined. Error: Result.

Message #

NGC auth ticket is not defined. Error: %1

Fields #

Name	Description
`Result` Int32

Event ID 1092: OAuth request retry.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

OAuth request retry. Correlation ID: OAuth_request_retry_Correlation_ID Retry: Retry.

Message #

OAuth request retry. Correlation ID: %1 Retry: %2

Fields #

Name	Description
`CorrelationID` UnicodeString
`RetryNumber` Int32

Event ID 1093: NGC call API returned error: Result.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

NGC call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString
`Result` Int32

References #

Microsoft Learn

Event ID 1094: Refresh token failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token failure. Status: Refresh_token_failure_Status Correlation ID: Correlation_ID.

Message #

Refresh token failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1095: Refresh token user SIDs don't match.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token user SIDs don't match. Correlation ID: value.

Message #

Refresh token user SIDs don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1096: Refresh token is expired.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token is expired. Correlation ID: value.

Message #

Refresh token is expired. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1097: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Level: Warning
Task: AadTokenBrokerPluginOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "{4DE9BC9C-B27A-43C9-8994-0915F1A5E24F}",
    "event_source_name": "",
    "event_id": 1097,
    "version": 0,
    "level": 3,
    "task": 103,
    "opcode": 0,
    "keywords": 4611686018427387952,
    "time_created": "2026-05-28T11:13:20.8708234+00:00",
    "event_record_id": 15,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0000-B545-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 7736,
      "thread_id": 7784
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Error": "2325807322",
    "ErrorMessage": "Upgrade default pawn task complete.",
    "AdditionalInformation": "Logged at UpdateDefaultPawn.cpp, line: 43, method: UpdateDefaultPawn::Apply."
  },
  "message": "Error: 0x8AA100DA Upgrade default pawn task complete.\r\nLogged at UpdateDefaultPawn.cpp, line: 43, method: UpdateDefaultPawn::Apply."
}

Event ID 1098: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Level: Error
Task: AadTokenBrokerPluginOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1098,
    "version": 0,
    "level": 2,
    "task": 103,
    "opcode": 0,
    "keywords": 4611686018427387922,
    "time_created": "2026-03-14T21:11:21.909514+00:00",
    "event_record_id": 25,
    "correlation": {},
    "execution": {
      "process_id": 10584,
      "thread_id": 10312
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Error": 3399811278,
    "ErrorMessage": "User requested add account.",
    "AdditionalInformation": "UI flow is completed with error\r\nLogged at WebUITokenRequest.cpp, line: 180, method: WebUITokenRequest::FinalizeUIFlow.\r\n\r\nRequest: authority: https://login.microsoftonline.com/organizations, client: d3590ed6-52b3-4102-aeff-aad2292ab01c, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/d3590ed6-52b3-4102-aeff-aad2292ab01c, resource: , correlation ID (request): a315d45d-ad27-4338-a603-c6283cfa75d2"
  },
  "message": ""
}

Event ID 1099: Code: Code OperationCode OperationMessage.

Channel: Analytic
Task: AadTokenBrokerPluginOperation

Description

Code: OperationCode OperationMessage AdditionalInformation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`OperationCode` UInt32
`OperationMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1100: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Task: AadAdalrtOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1101: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Task: AadAdalrtOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1102: Code: Code OperationCode OperationMessage.

Channel: Analytic
Task: AadAdalrtOperation

Description

Code: OperationCode OperationMessage AdditionalInformation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`OperationCode` UInt32
`OperationMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1103: Can't decrypt OAuth response.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Can't decrypt OAuth response. Error: Cant_decrypt_OAuth_response_Error.

Message #

Can't decrypt OAuth response. Error: %1

Fields #

Name	Description
`Result` Int32

Event ID 1104: AAD Cloud AP plugin call API returned error: Result.

Channel: Operational
Level: Error
Task: AadCloudAPPluginOperation

Message #

AAD Cloud AP plugin call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString
`Result` UInt32	1 returned error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "{4DE9BC9C-B27A-43C9-8994-0915F1A5E24F}",
    "event_source_name": "",
    "event_id": 1104,
    "version": 0,
    "level": 2,
    "task": 101,
    "opcode": 0,
    "keywords": 4611686018427387922,
    "time_created": "2026-05-29T16:32:50.6948431+00:00",
    "event_record_id": 25,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0001-1820-82C688EFDC01}"
    },
    "execution": {
      "process_id": 812,
      "thread_id": 816
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "API": "Plugin initialize",
    "Result": "3221521494"
  },
  "message": "AAD Cloud AP plugin call Plugin initialize returned error: 0xC0048456"
}

Event ID 1105: Device registration API call API returned error: Result.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Device registration API call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString
`Result` UInt32

Event ID 1106: Number of security groups received value.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Number of security groups received value. CorrelationID: CorrelationID.

Message #

Number of security groups received %1. CorrelationID: %2

Fields #

Name	Description
`value` Int32
`CorrelationID` UnicodeString

Event ID 1107: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadTokenBrokerPluginOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1108: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadTokenBrokerPluginOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1109: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadAdalrtOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1110: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadAdalrtOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1111: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Task: AadAadtbOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1112: Error: Error ErrorMessage AdditionalInformation.

Channel: Operational
Task: AadAadtbOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1113: Code: Code OperationCode OperationMessage.

Channel: Analytic
Task: AadAadtbOperation

Description

Code: OperationCode OperationMessage AdditionalInformation

Message #

Code: %1 %2
%3

Fields #

Name	Description
`OperationCode` UInt32
`OperationMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1114: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadAadtbOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1115: Error: Error ErrorMessage AdditionalInformation.

Channel: Analytic
Task: AadAadtbOperation

Description

Error: Error ErrorMessage AdditionalInformation

Message #

Error: %1 %2
%3

Fields #

Name	Description
`Error` UInt32
`ErrorMessage` UnicodeString
`AdditionalInformation` UnicodeString

Event ID 1116: Get Enterprise STS OAuth Info failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get Enterprise STS OAuth Info failure. Status: Status Correlation ID: CorrelationID.

Message #

Get Enterprise STS OAuth Info failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

References #

Microsoft Learn

Event ID 1117: Enterprise STS Refresh token failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Refresh token failure. Status: Status Correlation ID: CorrelationID.

Message #

Enterprise STS Refresh token failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

References #

Microsoft Learn

Event ID 1118: Enterprise STS Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Logon failure. Status: Enterprise_STS_Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Enterprise STS Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

References #

Microsoft Learn

Event ID 1119: Enterprise STS OAuth Info response: Enterprise_STS_OAuth_Info_response.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Enterprise STS OAuth Info response: %1.
Request status: %2

Fields #

Name	Description
`Response` UnicodeString
`Status` Int32	NTSTATUS reference

References #

Microsoft Learn

Event ID 1120: Enterprise STS Refresh token is expired.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise STS Refresh token is expired. Correlation ID: value.

Message #

Enterprise STS Refresh token is expired. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1121: Enterprise STS RefreshToken Correlation ID: value.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

Enterprise STS RefreshToken Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1122: Refresh token subject don't match.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Refresh token subject don't match. Correlation ID: value.

Message #

Refresh token subject don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1123: AadCloudAPPlugin smart card logon for non-federated user.

Channel: Operational
Task: AadCloudAPPluginOperation

Event ID 1124: Device is DRS joined but Enterprise STS is disabled: Status.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Device is DRS joined but Enterprise STS is disabled: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1125: AadCloudAPPlugin loaded as surrogate, no key recovery

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1126: AadCloudAPPlugin device is Enterprise joined

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1127: AadCloudAPPlugin device P2P certificate update thread started

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

References #

Microsoft Learn

Event ID 1128: AadCloudAPPlugin device P2P certificate update thread stopped

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1129: AadCloudAPPlugin Uninitialize Stop

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1130: AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: AadCloudAPPlugin_DeviceP2PCertificateUpdate_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin DeviceP2PCertificateUpdate Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1131: Update P2P device certificate failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Update P2P device certificate failure. Status: Status Correlation ID: CorrelationID.

Message #

Update P2P device certificate failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1132: AadCloudAPPlugin GetCertificateFromCred Correlation ID: AadCloudAPPlugin_GetCertificateFromCred_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin GetCertificateFromCred Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1133: Update P2P user certificate failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Update P2P user certificate failure. Status: Status Correlation ID: CorrelationID.

Message #

Update P2P user certificate failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1134: AAD Cloud AP plugin call API returned error: Result.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AAD Cloud AP plugin call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString
`Result` UInt32

Event ID 1135: AadCloudAPPlugin RenewCertificate Correlation ID: AadCloudAPPlugin_RenewCertificate_Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin RenewCertificate Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1136: AadCloudAPPlugin AcceptPeerCertificate Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1137: AadCloudAPPlugin AcceptPeerCertificate Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin AcceptPeerCertificate Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1138: AadCloudAPPlugin RenewCertificate Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1139: AadCloudAPPlugin RenewCertificate Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin RenewCertificate Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1140: AadCloudAPPlugin GetCertificateFromCred Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1141: AadCloudAPPlugin GetCertificateFromCred Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin GetCertificateFromCred Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1142: Get token user names don't match.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Get token user names don't match. Correlation ID: value.

Message #

Get token user names don't match. Correlation ID: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1143: Generic Call Package call type: Generic_Call_Packate_call_type.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Generic Call Package call type: Generic_Call_Packate_call_type. Correlation ID: Correlation_ID.

Message #

Generic Call Package call type: %1. Correlation ID: %2

Fields #

Name	Description
`value` Int32
`CorrelationID` UnicodeString

Event ID 1144: Realm discovery for: Method authority: EndpointUri fallback domain hint: CorrelationID useUpn: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Realm discovery for: %2 authority: %3 fallback domain hint: %4 useUpn: %1

Fields #

Name	Description
`value` Int32
`Method` UnicodeString
`EndpointUri` UnicodeString
`CorrelationID` UnicodeString

Event ID 1145: AAD Cloud AP plugin token needs refresh reason: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AAD Cloud AP plugin token needs refresh reason: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1146: Token is not refreshed.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token is not refreshed. token time: NoOfTargets update time: RequestType.

Message #

Token is not refreshed. token time: %1 update time: %2

Fields #

Name	Description
`NoOfTargets` UInt64
`RequestType` UInt64

Event ID 1147: AadCloudAPPlugin AssembleOpaqueData Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1148: AadCloudAPPlugin AssembleOpaqueData Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin AssembleOpaqueData Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1149: AadCloudAPPlugin DisassembleOpaqueData Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

References #

Microsoft Learn

Event ID 1150: AadCloudAPPlugin DisassembleOpaqueData Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin DisassembleOpaqueData Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1151: AadCloudAPPlugin P2P device certificate update error: Status.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin P2P device certificate update error: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1152: AadCloudAPPlugin device certificate key error: Result.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin device certificate key error: %1

Fields #

Name	Description
`Result` Int32

Event ID 1153: AadCloudAPPlugin device certificate not available for logon: value.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin device certificate not available for logon: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1154: Password expiration claims.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Password expiration claims. Seconds: Password_expiration_claims_Seconds URI: URI.

Message #

Password expiration claims. Seconds: %1 URI: %2

Fields #

Name	Description
`seconds` Int32
`URI` UnicodeString

Event ID 1155: Logon with session key failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon with session key failure. Retrying with device auth. Status: Status Correlation ID: CorrelationID.

Message #

Logon with session key failure. Retrying with device auth. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1156: Password expiration fields.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Password expiration fields. Status: Password_expiration_fields_Status Date: Date URI: URI.

Message #

Password expiration fields. Status: %1 Date: %2 URI: %3

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`ExpiryTime` FILETIME
`PasswordChangeURI` UnicodeString

Event ID 1157: AadCloudAPPlugin PostLogonProcessing Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1158: AadCloudAPPlugin PostLogonProcessing Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin PostLogonProcessing Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1159: AadCloudAPPlugin S4U logon failed.

Channel: Operational
Task: AadCloudAPPluginOperation
Opcode: Stop

Description

AadCloudAPPlugin S4U logon failed. Status: AadCloudAPPlugin_S2U_logon_failed_Status.

Message #

AadCloudAPPlugin S4U logon failed. Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1160: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1161: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1162: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1163: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1164: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1165: Logon failure.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Logon failure. Status: Logon_failure_Status Correlation ID: Correlation_ID.

Message #

Logon failure. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1200: BrowserCore operation started

Channel: Analytic
Task: BrowserCoreOperation
Opcode: Start

Event ID 1201: BrowserCore operation completed successfully

Channel: Analytic
Task: BrowserCoreOperation
Opcode: Stop

Message #

BrowserCore operation completed successfully.
Method: %1
CorrelationID: %2

Fields #

Name	Description
`Method` UnicodeString
`CorrelationID` UnicodeString

Event ID 1202: BrowserCore operation completed with a failure.

Channel: Operational
Task: BrowserCoreOperation
Opcode: Stop

Message #

BrowserCore operation completed with a failure.
Error: %1
Error Message: %2
Method: %3
CorrelationID: %4

Fields #

Name	Description
`Result` Int32
`ErrorMessage` UnicodeString
`Method` UnicodeString
`CorrelationID` UnicodeString

Event ID 1203: BrowserCore inner operation FunctionName completed with error: Result.

Channel: Operational
Task: BrowserCoreOperation

Message #

BrowserCore inner operation %2 completed with error: %1

Fields #

Name	Description
`Result` Int32
`FunctionName` AnsiString

Event ID 1204: AadCloudAPPlugin LookupSIDFromIdentityName Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1205: AadCloudAPPlugin LookupSIDFromIdentityName Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin LookupSIDFromIdentityName Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1206: AadCloudAPPlugin LookupIdentityFromSIDName Start

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Event ID 1207: AadCloudAPPlugin LookupIdentityFromSIDName Stop.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Stop

Message #

AadCloudAPPlugin LookupIdentityFromSIDName Stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1208: AadCloudAPPlugin LookupSIDFromIdentity Identity: AadCloudAPPlugin_LookupSIDFromIdentity_Identity Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin LookupSIDFromIdentity Identity: %1 Correlation ID: %2

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 1209: AadCloudAPPlugin LookupIdentityFromSID SID: AadCloudAPPlugin_LookupIdentityFromSID_SID Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

AadCloudAPPlugin LookupIdentityFromSID SID: %1 Correlation ID: %2

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 1210: AadCloudAPPlugin password expired, password change URI: value.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin password expired, password change URI: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1211: Writing RunRecovery registry value failed.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Writing RunRecovery registry value failed.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1212: Enterprise logon.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Enterprise logon. Password is expired.

Message #

Enterprise logon. Password is expired.
Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1213: WamExtension process token operation started

Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Event ID 1214: WamExtension process token operation completed successfully

Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Event ID 1215: WamExtension process token operation completed with error: Data.

Channel: Operational
Level: Error
Task: WamExtensionOperation
Opcode: Stop

Message #

WamExtension process token operation completed with error: %1

Fields #

Name	Description
`Result`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AAD",
    "guid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F",
    "event_source_name": "",
    "event_id": 1215,
    "version": 0,
    "level": 2,
    "task": 107,
    "opcode": 2,
    "keywords": 4611686018427387922,
    "time_created": "2022-04-07T16:44:49.386586+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 2080,
      "thread_id": 2748
    },
    "channel": "Microsoft-Windows-AAD/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "Result",
      "Value": "\u0004�\u0004�"
    }
  },
  "message": ""
}

Example keys not documented in the fields table: Data

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1216: WamExtension device authentication call status: Result Correlation ID: Target.

Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Message #

WamExtension device authentication call status: %1 Correlation ID: %2

Fields #

Name	Description
`Result` Int32
`Target` UnicodeString

Event ID 1217: Get device token.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Get device token. Resource: Get_device_token_Resource ClientID: ClientID Scope: Scope.

Message #

Get device token. Resource: %1 ClientID: %2 Scope: %3

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString
`value3` UnicodeString

Event ID 1218: StartFidoAuthenticationSession start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1219: StartFidoAuthenticationSession stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

StartFidoAuthenticationSession stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1220: CloseFidoAuthenticationSession start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1221: CloseFidoAuthenticationSession stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

CloseFidoAuthenticationSession stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1222: GetClientData start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1223: GetClientData stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

GetClientData stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1224: SignClientDataFido start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1225: SignClientDataFido stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

SignClientDataFido stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1226: ChangePin start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1227: ChangePin stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

ChangePin stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1228: GetSerializedAuthBuffer start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1229: GetSerializedAuthBuffer stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

GetSerializedAuthBuffer stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1230: AuthHelper call API returned error: Result.

Channel: Operational
Task: AuthHelper

Message #

AuthHelper call %1 returned error: %2

Fields #

Name	Description
`API` UnicodeString
`Result` UInt32

Event ID 1231: AadCloudAPPlugin Resource infomation: AadCloudAPPlugin_Resource_infomation.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin Resource infomation: %1.
Request status: %2

Fields #

Name	Description
`Response` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 1232: AadCloudAPPlugin RBAC authorization code response: Response.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin RBAC authorization code response: %1.
Request status: %2

Fields #

Name	Description
`Response` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 1233: AadCloudAPPlugin User access control role: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin User access control role: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1234: AadCloudAPPlugin using resource id from the Idtoken: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AadCloudAPPlugin using resource id from the Idtoken: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1235: RBAC Status: RBAC_Status Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

RBAC Status: %1 Correlation ID: %2

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`CorrelationID` UnicodeString

Event ID 1236: Failed to create the resource id

Channel: Analytic
Task: AadCloudAPPluginOperation

Event ID 1237: Device is configured for RBAC authorization

Channel: Operational
Task: AadCloudAPPluginOperation

Event ID 1238: Not sending the client certificate as it is optional on the server

Channel: Analytic
Task: AadCloudAPPluginOperation

Event ID 1239: Doing RBAC logon of the device type: value.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Doing RBAC logon of the device type: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1240: Skipping Rbac Logon because AadCloudAPPlugin is loaded as surrogate

Channel: Analytic
Task: AadCloudAPPluginOperation

Event ID 1241: On-prem tgt error: Onprem_tgt_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

On-prem tgt error: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1242: Added user to admins security group

Channel: Analytic
Task: AadCloudAPPluginOperation

Event ID 1243: Removed user from admins security group

Channel: Analytic
Task: AadCloudAPPluginOperation

Event ID 1244: Security groups were not loaded.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Security groups were not loaded. Error: Status.

Message #

Security groups were not loaded. Error: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1245: Security groups were not updated.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

Security groups were not updated. Error: Status.

Message #

Security groups were not updated. Error: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1246: User sid: User_sid Group sids: Group_sids.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

User sid: value1 Group sids: value2

Message #

User sid: %1
Group sids:
%2

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 1247: RunRecovery registry value (Context) successfully written.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

RunRecovery registry value (%1) successfully written.
Context: %2
Reason: %3

Fields #

Name	Description
`value` Int32
`Context` UnicodeString
`Result` Int32

Event ID 1248: AuthHelper auth buff local nonce

Channel: Operational
Task: AuthHelper

Event ID 1249: Cloud tgt error: Cloud_tgt_error.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Cloud tgt error: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1250: DoGetToken Diagnostic Event.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

DoGetToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoGetToken Diagnostic Event] Result.
`UserIdentity` UnicodeString
`CredentialType` Int32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`CorrelationID` UnicodeString
`EndpointUri` UnicodeString
`Method` UnicodeString
`HTTPTransportError` Int32
`HTTPStatus` Int32
`ErrorCode` UnicodeString	[DoGetToken Diagnostic Event] ErrorCode.
`ErrorDescription` UnicodeString

Event ID 1251: DoGetEnterpriseToken Diagnostic Event.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

DoGetEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoGetEnterpriseToken Diagnostic Event] Result.
`UserIdentity` UnicodeString
`CredentialType` Int32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`CorrelationID` UnicodeString
`EndpointUri` UnicodeString
`Method` UnicodeString
`HTTPTransportError` Int32
`HTTPStatus` Int32
`ErrorCode` UnicodeString	[DoGetEnterpriseToken Diagnostic Event] ErrorCode.
`ErrorDescription` UnicodeString

Event ID 1252: DoRefreshToken Diagnostic Event.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

DoRefreshToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoRefreshToken Diagnostic Event] Result.
`UserIdentity` UnicodeString
`CredentialType` Int32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`NewToken` Boolean
`CorrelationID` UnicodeString
`EndpointUri` UnicodeString
`Method` UnicodeString
`HTTPTransportError` Int32
`HTTPStatus` Int32
`ErrorCode` UnicodeString	[DoRefreshToken Diagnostic Event] ErrorCode.
`ErrorDescription` UnicodeString

Event ID 1253: DoRefreshEnterpriseToken Diagnostic Event.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

DoRefreshEnterpriseToken Diagnostic Event:
Result: %1
User Identity: %2
Credential Type: %3
Correlation ID: %4
Endpoint Uri: %5
HTTP Status: %6
HTTP Method: %7
ErrorCode: %8
Error Description: %9

Fields #

Name	Description
`Result` UInt32	[DoRefreshEnterpriseToken Diagnostic Event] Result.
`UserIdentity` UnicodeString
`CredentialType` Int32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`NewToken` Boolean
`CorrelationID` UnicodeString
`EndpointUri` UnicodeString
`Method` UnicodeString
`HTTPTransportError` Int32
`HTTPStatus` Int32
`ErrorCode` UnicodeString	[DoRefreshEnterpriseToken Diagnostic Event] ErrorCode.
`ErrorDescription` UnicodeString

Event ID 1254: Response content type: Response_content_type.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Response content type: %1

Fields #

Name	Description
`value` UnicodeString

Event ID 1255: AD TGT: AD_TGT Cloud TGT: Cloud_TGT.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

AD TGT: %1 Cloud TGT: %2

Fields #

Name	Description
`NoOfTargets` UInt32
`RequestType` UInt32

Event ID 1256: P2P certificate update error.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

P2P certificate update error. Status: P2P_certificate_update_error_Status Correlation ID: Correlation_ID.

Message #

P2P certificate update error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Result` Int32
`Target` UnicodeString

Event ID 1257: Credbuffer correlation ID: Credbuffer_correlation_ID Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

Credbuffer correlation ID: %1 Correlation ID: %2

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 1258: CA cert hash (keyID): CA_cert_hash_keyID Correlation ID: Correlation_ID.

Channel: Analytic
Task: AadCloudAPPluginOperation
Opcode: Start

Message #

CA cert hash (keyID): %1 Correlation ID: %2

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 1259: CA certificate update error.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

CA certificate update error. Status: CA_certificate_update_error_Status Correlation ID: Correlation_ID.

Message #

CA certificate update error. Status: %1 Correlation ID: %2

Fields #

Name	Description
`Result` Int32
`Target` UnicodeString

Event ID 1260: RetryGetClientData start

Channel: Analytic
Task: AuthHelper
Opcode: Start

Event ID 1261: RetryGetClientData stop.

Channel: Analytic
Task: AuthHelper
Opcode: Stop

Message #

RetryGetClientData stop.
Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1262: Binding key tag check failed: Binding_key_tag_check_failed.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

Binding key tag check failed: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1263: BrowserCore inner operation FunctionName with account pairwiseID PairwiseID not found error.

Channel: Operational
Task: BrowserCoreOperation

Message #

BrowserCore inner operation %2 with account pairwiseID %1 not found error

Fields #

Name	Description
`PairwiseID` UnicodeString
`FunctionName` AnsiString

Event ID 1264: Token binding key created.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding key created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString

Event ID 1265: WamExtension preprocess token operation started.

Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Event ID 1266: WamExtension preprocess token operation completed successfully

Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Event ID 1267: WamExtension preprocess token operation completed with error: Result.

Channel: Operational
Task: WamExtensionOperation
Opcode: Stop

Message #

WamExtension preprocess token operation completed with error: %1

Fields #

Name	Description
`Result` Int32

Event ID 1268: WamExtension postprocess token operation started.

Channel: Analytic
Task: WamExtensionOperation
Opcode: Start

Message #

WamExtension postprocess token operation started.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString

Event ID 1269: WamExtension postprocess token operation completed successfully.

Channel: Analytic
Task: WamExtensionOperation
Opcode: Stop

Message #

WamExtension postprocess token operation completed successfully.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString

Event ID 1270: WamExtension postprocess token operation completed with error: Result.

Channel: Operational
Task: WamExtensionOperation
Opcode: Stop

Message #

WamExtension postprocess token operation completed with error: %2.
Stage: %1

Fields #

Name	Description
`Stage` UnicodeString
`Result` Int32

Event ID 1271: Token binding claim(s) included in the request.

Channel: Analytic
Task: AadCloudAPPluginOperation

Description

Token binding claim(s) included in the request. Correlation ID: CorrelationID.

Message #

Token binding claim(s) included in the request. Correlation ID: %1

Fields #

Name	Description
`CorrelationID` UnicodeString

Event ID 1272: Token binding key is not healthy and needs to be re-created.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding key is not healthy and needs to be re-created.
Key Type: %1
Client: %2
Resource: %3
Scope: %4
Test result: %5

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString
`KeyTestResult` Int32

Event ID 1273: Token binding claims need to be re-generated due to changes in attestation key(s).

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims need to be re-generated due to changes in attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString

Event ID 1274: Token binding claims generated.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims generated.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString

Event ID 1275: Token binding claims generated for UI request.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims generated for UI request.
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString

Event ID 1276: Token binding claims count: ClaimsCount.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims count: %1

Fields #

Name	Description
`ClaimsCount` Int32

Event ID 1277: KeyGuard availability detection failed.

Channel: Operational
Task: AadCloudAPPluginOperation

Description

KeyGuard availability detection failed. Error: Result.

Message #

KeyGuard availability detection failed. Error: %1

Fields #

Name	Description
`Result` Int32

Event ID 1278: KeyGuard with attestation support is not detected.

Channel: Operational
Task: AadCloudAPPluginOperation

Event ID 1279: Token binding claims of type KeyType could not be generated because AIK does not exist.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims of type %1 could not be generated because AIK does not exist.
Join Type: %2
Tenant ID: %3

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`JoinType` Int32
`TenantId` UnicodeString

Event ID 1280: PRT session key needs to be rolled.

Channel: Operational
Task: AadCloudAPPluginOperation

Message #

PRT session key needs to be rolled.
Reason: %1

Fields #

Name	Description
`RollReason` UnicodeString

Event ID 1281: Token binding key deleted.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding key deleted.
Key: %1

Fields #

Name	Description
`Key` UnicodeString

Event ID 1282: SHR property in request is not allowed.

Channel: Operational
Task: WamExtensionOperation

Description

SHR property in request is not allowed. Property: PropertyName.

Message #

SHR property in request is not allowed. Property: %1

Fields #

Name	Description
`PropertyName` UnicodeString

Event ID 1283: Invalid registry value was ignored.

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Invalid registry value was ignored.
Location: %1
Value name: %2
Value: %3

Fields #

Name	Description
`RegistryLocation` UnicodeString
`RegistryValueName` UnicodeString
`Value` HexInt32

Event ID 1284: Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).

Channel: Analytic
Task: AadCloudAPPluginOperation

Message #

Token binding claims need to be re-generated as cached claims were generated for different attestation key(s).
Key Type: %1
Client: %2
Resource: %3
Scope: %4

Fields #

Name	Description
`KeyType` Int32	Known values `%%2499` Machine key `%%2500` User key
`ClientId` UnicodeString
`Resource` UnicodeString
`Scope` UnicodeString

Provenance

ETW provider GUID 4de9bc9c-b27a-43c9-8994-0915f1a5e24f

Defined in aadcloudAP.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB