detection.wiki

Microsoft-Windows-AuthenticationProvider

EventTitleChannelSampleRule
101The security package does not cache the credentials needed to authenticate to …ProtectedUser-ClientNN
304The security package does not cache the user's sign on credentials.ProtectedUser-ClientNN

Event ID 101: The security package does not cache the credentials needed to authenticate to the server.

#
Channel
ProtectedUser-Client

Message #

The security package does not cache the credentials needed to authenticate to the server.

Package Name: %1
User Name: %2
Domain Name: %3
Server Name: %4
Protected User: %5
Error Code: %6

Fields #

NameDescription
PackageName UnicodeString
UserName UnicodeString
DomainName UnicodeString
ServerName UnicodeString
ProtectedUser UInt32
ErrorCode HexInt32

Event ID 304: The security package does not cache the user's sign on credentials.

#
Channel
ProtectedUser-Client

Message #

The security package does not cache the user's sign on credentials.

Package Name: %1
User Name: %2
Domain Name: %3
Protected User: %4

Fields #

NameDescription
PackageName UnicodeString
UserName UnicodeString
DomainName UnicodeString
ProtectedUser UInt32

Provenance

ETW provider GUID dddc1d91-51a1-4a8d-95b5-350c4ee3d809

Defined in lsasrv.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3804, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB