detection.wiki

Microsoft-Windows-Biometrics

EventTitleChannelSampleRule
1000The Windows Biometric Service could not verify Username (SID) using sensor: …OperationalNN
1001The Windows Biometric Service successfully verified Username (SID) using sensor: …OperationalNN
1002The Windows Biometric Service could not match Username (SID) with the sample …OperationalNN
1003The Windows Biometric Service could not complete an identification operation …OperationalNN
1004The Windows Biometric Service successfully identified Username (SID) using …OperationalNN
1005The Windows Biometric Service could not determine the identity of the sample …OperationalNN
1006The Windows Biometric Service started an enrollment operation using sensor: …OperationalNN
1007The Windows Biometric Service encountered an error while processing and updating …OperationalNN
1008The Windows Biometric Service is processing an enrollment operation and updating …OperationalNN
1009The Windows Biometric Service failed to enroll Username (SID) using sensor: …OperationalNN
1010The Windows Biometric Service successfully enrolled Username (SID) using sensor: …OperationalNN
1011The Windows Biometric Service failed to begin a capture operation using sensor: …OperationalNN
1012The Windows Biometric Service failed to complete a capture operation using …OperationalNN
1013The Windows Biometric Service failed to export data from sensor: …OperationalNN
1014The Windows Biometric Service failed to delete a database record for Username …OperationalNN
1015The Windows Biometric Service successfully deleted a database record for …OperationalNN
1016The Windows Biometric Service failed to complete a vendor-specific operation for …OperationalNN
1017The Windows Biometric Service completed a vendor-specific operation for sensor: …OperationalNN
1018The Windows Biometric Service failed to complete a privileged vendor-specific …OperationalNN
1019The Windows Biometric Service completed a privileged vendor-specific operation …OperationalNN
1020The Windows Biometric Service cannot complete a request because biometric …OperationalNN
1021The Windows Biometric Service cannot complete a request because Terminal Server …OperationalNN
1100The Windows Biometric Service failed to load an adapter binary: ModulePath.OperationalNN
1101The Windows Biometric Service failed to load an adapter binary: ModulePath.OperationalNN
1102The Windows Biometric Service failed to load an adapter binary: ModulePath.OperationalNN
1103The Windows Biometric Service failed to open sensor: BiometricSensor.OperationalNN
1104The Windows Biometric Service failed to set the mode of sensor: BiometricSensor.OperationalNN
1105The Windows Biometric Service failed to initialize an adapter binary: …OperationalNN
1106The Windows Biometric Service detected a missing or invalid biometric database …OperationalNN
1107The Windows Biometric Service encountered an error while opening the database …OperationalNN
1108The Windows Biometric Service successfully created a Biometric Unit for sensor: …OperationalYN
1109The Windows Biometric Service failed to configure a Biometric Unit for sensor: …OperationalNN
1110The Windows Biometric Service failed to create a Biometric Unit for sensor: …OperationalNN
1111The Windows Biometric Service failed to create a Biometric Unit for sensor: …OperationalNN
1112The Windows Biometric Service failed to complete the calibration setup protocol: …OperationalNN
1113The Windows Biometric Service failed to load an adapter binary: ModulePath.OperationalNN
1114The Windows Biometric Service failed to transfer private sensor type information …OperationalNN
1115The Windows Biometric Service's Source policy configuration.OperationalNN
1116The Windows Biometric Service's ESS state configuration.OperationalNN
1400The Windows Fingerprint Credential Provider could not log Username on because …OperationalNN
1401The Windows Fingerprint Credential Provider failed to enumerate its tile.OperationalNN
1402The Windows Fingerprint Credential Provider could not log Username on because …OperationalNN
1403The Windows Fingerprint Credential Provider has disabled biometric …OperationalNN
1500The Windows Biometric Credential Manager successfully stored a credential for …OperationalNN
1501The Windows Biometric Credential Manager failed to store a credential for …OperationalNN
1502The Windows Biometric Credential Manager failed to store a credential because …OperationalNN
1503The Windows Biometric Credential Manager failed to store a credential.OperationalNN
1504The Windows Biometric Credential Manager successfully removed a credential for …OperationalNN
1505The Windows Biometric Credential Manager failed to remove a credential for …OperationalNN
1506The Windows Biometric Credential Manager failed to remove a credential because …OperationalNN
1507The Windows Biometric Credential Manager failed to remove a credential.OperationalNN
1508The Windows Biometric Credential Manager successfully retrieved the credential …OperationalNN
1509The Windows Biometric Credential Manager failed to retrieve the credential state …OperationalNN
1510The Windows Biometric Credential Manager failed to retrieve the credential state …OperationalNN
1511The Windows Biometric Credential Manager failed to retrieve the state of a …OperationalNN
1512The Windows Biometric Credential Manager successfully switched to user Username …OperationalNN
1513The Windows Biometric Credential Manager failed to switch to user Username (SID) …OperationalNN
1514The Windows Biometric Credential Manager failed to switch to the specified user …OperationalNN
1515The Windows Biometric Credential Manager failed to switch to user Username (SID) …OperationalNN
1516The Windows Biometric Credential Manager failed to switch to the specified user.OperationalNN
1600The Windows Biometric Service failed to start its secure component.OperationalYN
1601The Windows Biometric Service successfully started its secure component.OperationalNN
1602The Windows Biometric Service failed to migrate templates into Virtual Secure …OperationalNN
1603The Windows Biometric Service successfully migrated templates into Virtual …OperationalNN
1604The Windows Biometric Service secure component was compromised.OperationalNN
1605The Windows Biometric Service secure component successfully authorized user …OperationalNN
1606The Windows Biometric Service secure component successfully redeemed an …OperationalNN
1607The Windows Biometric Service secure componets successfully established a secure …OperationalNN
1608The Windows Biometric Service secure componets successfully reestablished a …OperationalNN
1609The Windows Biometric Service secure component failed to establish a secure …OperationalNN
1610The Windows Biometric Service secure component failed to delete an authorized …OperationalNN
1611The Windows Biometric Service secure component successfully deleted an …OperationalNN
1700The Windows Biometric Service successfully protected data for user SID (Type).OperationalNN
1701The Windows Biometric Service failed to protect data for user Username (SID).OperationalNN
1702The Windows Biometric Service successfully unprotected data for user SID (Type).OperationalNN
1703The Windows Biometric Service failed to unprotect data for user Username (SID).OperationalNN
7000WBioSrvcStartAnalyticNN
7001WBioSrvcStopAnalyticNN
7002WBioSrvcStart7002AnalyticNN
7003WBioSrvcStop7003AnalyticNN
7004WBioSrvcStart7004AnalyticNN
7005WBioSrvcStop7005AnalyticNN
7006WBioSrvcStart7006AnalyticNN
7007WBioSrvcStop7007AnalyticNN
7008WBioSrvcStart7008AnalyticNN
7009WBioSrvcStop7009AnalyticNN
7010WBioSrvcStart7010AnalyticNN
7011WBioSrvcStop7011AnalyticNN
7012WBioSrvcStart7012AnalyticNN
7013WBioSrvcStop7013AnalyticNN

Event ID 1000: The Windows Biometric Service could not verify Username (SID) using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service could not verify %13 (%12) using sensor: %1.

The operation failed with error: %14.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1001: The Windows Biometric Service successfully verified Username (SID) using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully verified %13 (%12) using sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1002: The Windows Biometric Service could not match Username (SID) with the sample from sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service could not match %13 (%12) with the sample from sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1003: The Windows Biometric Service could not complete an identification operation using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service could not complete an identification operation using sensor: %1.

The operation failed with error: %12

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1004: The Windows Biometric Service successfully identified Username (SID) using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully identified %13 (%12) using sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1005: The Windows Biometric Service could not determine the identity of the sample from sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service could not determine the identity of the sample from sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString

Event ID 1006: The Windows Biometric Service started an enrollment operation using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service started an enrollment operation using sensor: %1

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString

Event ID 1007: The Windows Biometric Service encountered an error while processing and updating an enrollment request using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service encountered an error while processing and updating an enrollment request using sensor: %1.

The operation failed with error: %12

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1008: The Windows Biometric Service is processing an enrollment operation and updating an enrollment using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service is processing an enrollment operation and updating an enrollment using sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString

Event ID 1009: The Windows Biometric Service failed to enroll Username (SID) using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to enroll %13 (%12) using sensor: %1.

The operation failed with error: %14.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1010: The Windows Biometric Service successfully enrolled Username (SID) using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully enrolled %13 (%12) using sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1011: The Windows Biometric Service failed to begin a capture operation using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to begin a capture operation using sensor: %1.

The operation failed with error: %12

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1012: The Windows Biometric Service failed to complete a capture operation using sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to complete a capture operation using sensor: %1.

The operation failed with error: %12, reject detail: %13

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32
RejectDetail UInt32

Event ID 1013: The Windows Biometric Service failed to export data from sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to export data from sensor: %1.

The operation failed with error: %12

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1014: The Windows Biometric Service failed to delete a database record for Username (SID) on sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to delete a database record for %13 (%12) on sensor: %1.

The operation failed with error: %14.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1015: The Windows Biometric Service successfully deleted a database record for Username (SID) on sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully deleted a database record for %13 (%12) on sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1016: The Windows Biometric Service failed to complete a vendor-specific operation for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to complete a vendor-specific operation for sensor: %1.

The command was directed to the biometric unit's "%12" component.

The operation failed with error: %15

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ControlCode HexInt32
OperationStatus HexInt32NTSTATUS reference
ErrorCode HexInt32

Event ID 1017: The Windows Biometric Service completed a vendor-specific operation for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service completed a vendor-specific operation for sensor: %1.

The command was directed to the biometric unit's "%12" component.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ControlCode HexInt32
OperationStatus HexInt32NTSTATUS reference

Event ID 1018: The Windows Biometric Service failed to complete a privileged vendor-specific operation for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to complete a privileged vendor-specific operation for sensor: %1.

The command was directed to the biometric unit's "%12" component.

The operation failed with error: %15

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ControlCode HexInt32
OperationStatus HexInt32NTSTATUS reference
ErrorCode HexInt32

Event ID 1019: The Windows Biometric Service completed a privileged vendor-specific operation for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service completed a privileged vendor-specific operation for sensor: %1.

The command was directed to the biometric unit's "%12" component.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ControlCode HexInt32
OperationStatus HexInt32NTSTATUS reference

Event ID 1020: The Windows Biometric Service cannot complete a request because biometric operations are disabled by current system policy.

#
Channel
Operational
Task
WBioSrvc

Event ID 1021: The Windows Biometric Service cannot complete a request because Terminal Server client sessions are not allowed to access the System sensor pool.

#
Channel
Operational
Task
WBioSrvc

Event ID 1100: The Windows Biometric Service failed to load an adapter binary: ModulePath.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to load an adapter binary: %1.

The operation failed with error: %2.

Fields #

NameDescription
ModulePath UnicodeString
ErrorCode HexInt32

Event ID 1101: The Windows Biometric Service failed to load an adapter binary: ModulePath.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to load an adapter binary: %1.

The module's "Force Integrity" flag was not set.

Fields #

NameDescription
ModulePath UnicodeString

Event ID 1102: The Windows Biometric Service failed to load an adapter binary: ModulePath.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to load an adapter binary: %1.

The module's "%2" interface is not valid.

Fields #

NameDescription
ModulePath UnicodeString
Component UInt32

Event ID 1103: The Windows Biometric Service failed to open sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to open sensor: %1.

The operation failed with error: %2

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1104: The Windows Biometric Service failed to set the mode of sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to set the mode of sensor: %1.

The operation failed with error: %12

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1105: The Windows Biometric Service failed to initialize an adapter binary: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to initialize an adapter binary: %1.

The module's "%12" initialization routine failed with error: %13

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ErrorCode HexInt32

Event ID 1106: The Windows Biometric Service detected a missing or invalid biometric database configuration for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service detected a missing or invalid biometric database configuration for sensor: %1.

The operation failed with error: %12

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1107: The Windows Biometric Service encountered an error while opening the database associated with sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service encountered an error while opening the database associated with sensor: %1.

The operation failed with error: %12

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1108: The Windows Biometric Service successfully created a Biometric Unit for sensor: BiometricSensor.

#
Channel
Operational
Level
Verbose
Task
WBioSrvc

Message #

The Windows Biometric Service successfully created a Biometric Unit for sensor: %1

The sensor's mode is "%6," its pool-type is "%7," and it's isolated in a "%8" process.

See the "Details" pane for additional information about the sensor's new configuration.

Fields #

NameDescription
BiometricSensor UnicodeStringThe Windows Biometric Service successfully created a Biometric Unit for sensor.
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Biometrics",
    "guid": "{A0E3D8EA-C34F-4419-A1DB-90435B8B21D0}",
    "event_source_name": "",
    "event_id": 1108,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T04:29:41.5895906+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 7288,
      "thread_id": 7420
    },
    "channel": "Microsoft-Windows-Biometrics/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BiometricSensor": "Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})",
    "SensorAdapter": "NUIVoiceWBSAdapters.dll",
    "EngineAdapter": "NUIVoiceWBSAdapters.dll",
    "StorageAdapter": "WinBioStorageAdapter.dll",
    "DatabaseID": "{51f39552-1075-4199-b513-0c10ea185db0}",
    "SensorMode": "1",
    "SensorPool": "1",
    "IsolationLevel": "0",
    "IsolationSensorAdapter": "-",
    "IsolationEngineAdapter": "-",
    "IsolationStorageAdapter": "-"
  },
  "message": "The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\r\rThe sensor's mode is \"Basic,\" its pool-type is \"System,\" and it's isolated in a \"Local System\" process.\r\rSee the \"Details\" pane for additional information about the sensor's new configuration."
}

Event ID 1109: The Windows Biometric Service failed to configure a Biometric Unit for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to configure a Biometric Unit for sensor: %1.

The operation failed with error: %12

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
ErrorCode HexInt32

Event ID 1110: The Windows Biometric Service failed to create a Biometric Unit for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to create a Biometric Unit for sensor: %1.

The driver installation package has missing or incorrect configuration values. Contact your PC support personnel for assistance.

The operation failed with error: %2

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1111: The Windows Biometric Service failed to create a Biometric Unit for sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to create a Biometric Unit for sensor: %1.

The operation failed with error: %2

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1112: The Windows Biometric Service failed to complete the calibration setup protocol: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to complete the calibration setup protocol: %1.

The "%12" failed with error: %13

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ErrorCode HexInt32

Event ID 1113: The Windows Biometric Service failed to load an adapter binary: ModulePath.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to load an adapter binary: %1.

The module was not properly signed.

Fields #

NameDescription
ModulePath UnicodeString

Event ID 1114: The Windows Biometric Service failed to transfer private sensor type information to the matching engine: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to transfer private sensor type information to the matching engine: %1.

The "%12" failed with error: %13

See the "Details" pane for information about the failing configuration.

Fields #

NameDescription
BiometricSensor UnicodeString
SensorAdapter UnicodeString
EngineAdapter UnicodeString
StorageAdapter UnicodeString
DatabaseID GUID
SensorMode UInt32
SensorPool UInt32
IsolationLevel UInt32
IsolationSensorAdapter UnicodeString
IsolationEngineAdapter UnicodeString
IsolationStorageAdapter UnicodeString
Component UInt32
ErrorCode HexInt32

Event ID 1115: The Windows Biometric Service's Source policy configuration.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service's %1 policy configuration:
Value: %3
Source: %2

Fields #

NameDescription
Configuration UnicodeString
Source UInt32
Value UInt32

Event ID 1116: The Windows Biometric Service's ESS state configuration.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service's ESS state configuration:
Requires TPM: %1
VBS capable: %2
Non VBS Windows Hello: %3
VBS Windows Hello: %4
Requires VBS Runnig: %5
Requires VBS Encryption keys: %6
Requires enablement: %7
Managed by policy: %8
Non VBS Bio Enrollments: %9
VBS Bio enrollments: %10
ESS face sensor: %11
ESS fpr sensor: %12
Requires isolated process: %13
Blocked non ESS fpr: %14
Blocked non ESS camera: %15
Is device ESS state default: %16

Fields #

NameDescription
requiresTPM Boolean
isVBSCapable Boolean
hasNonVBSWindowsHello Boolean
hasVBSWindowsHello Boolean
requiresVBSRunning Boolean
requiresVBSEncryptionKeys Boolean
requiresEnablement Boolean
managedByPolicy Boolean
hasNonVBSBiometricEnrollments Boolean
hasVBSBiometricEnrollments Boolean
hasESSFaceSensor Boolean
hasESSFprSensor Boolean
requiresIsolatedProcess Boolean
hasBlockedNonESSFpr Boolean
hasBlockedNonESSCamera Boolean
isDeviceEssSourceDefault Boolean

Event ID 1400: The Windows Fingerprint Credential Provider could not log Username on because the stored credential was invalid.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Fingerprint Credential Provider could not log %1 on because the stored credential was invalid.

Fields #

NameDescription
Username UnicodeString

Event ID 1401: The Windows Fingerprint Credential Provider failed to enumerate its tile.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Fingerprint Credential Provider failed to enumerate its tile.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1402: The Windows Fingerprint Credential Provider could not log Username on because the user does not have a credential stored for biometric logon.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Fingerprint Credential Provider could not log %1 on because the user does not have a credential stored for biometric logon.

Fields #

NameDescription
Username UnicodeString

Event ID 1403: The Windows Fingerprint Credential Provider has disabled biometric authentication.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Fingerprint Credential Provider has disabled biometric authentication.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1500: The Windows Biometric Credential Manager successfully stored a credential for Username (SID).

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager successfully stored a credential for %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1501: The Windows Biometric Credential Manager failed to store a credential for Username (SID) due to the caller having insufficient privileges.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to store a credential for %2 (%1) due to the caller having insufficient privileges.

The operation failed with error: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1502: The Windows Biometric Credential Manager failed to store a credential because the Windows Fingerprint Credential Provider is disabled.

#
Channel
Operational
Task
BioCredProv

Event ID 1503: The Windows Biometric Credential Manager failed to store a credential.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to store a credential.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1504: The Windows Biometric Credential Manager successfully removed a credential for Username (SID).

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager successfully removed a credential for %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1505: The Windows Biometric Credential Manager failed to remove a credential for Username (SID) due to the caller having insufficient privileges.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to remove a credential for %2 (%1) due to the caller having insufficient privileges.

The operation failed with error: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1506: The Windows Biometric Credential Manager failed to remove a credential because the Windows Fingerprint Credential Provider is disabled.

#
Channel
Operational
Task
BioCredProv

Event ID 1507: The Windows Biometric Credential Manager failed to remove a credential.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to remove a credential.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1508: The Windows Biometric Credential Manager successfully retrieved the credential state for Username (SID).

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager successfully retrieved the credential state for %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1509: The Windows Biometric Credential Manager failed to retrieve the credential state for Username (SID) due to the caller having insufficient privileges.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to retrieve the credential state for %2 (%1) due to the caller having insufficient privileges.

The operation failed with error: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1510: The Windows Biometric Credential Manager failed to retrieve the credential state because the Windows Fingerprint Credential Provider is disabled.

#
Channel
Operational
Task
BioCredProv

Event ID 1511: The Windows Biometric Credential Manager failed to retrieve the state of a credential.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to retrieve the state of a credential.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1512: The Windows Biometric Credential Manager successfully switched to user Username (SID).

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager successfully switched to user %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1513: The Windows Biometric Credential Manager failed to switch to user Username (SID) due to the caller having insufficient privileges.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to switch to user %2 (%1) due to the caller having insufficient privileges.

The operation failed with error: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1514: The Windows Biometric Credential Manager failed to switch to the specified user because the Windows Fingerprint Credential Provider is disabled.

#
Channel
Operational
Task
BioCredProv

Event ID 1515: The Windows Biometric Credential Manager failed to switch to user Username (SID) because they are already the interactive user.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to switch to user %2 (%1) because they are already the interactive user.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1516: The Windows Biometric Credential Manager failed to switch to the specified user.

#
Channel
Operational
Task
BioCredProv

Message #

The Windows Biometric Credential Manager failed to switch to the specified user.

The operation failed with error: %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 1600: The Windows Biometric Service failed to start its secure component.

#
Channel
Operational
Level
Informational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to start its secure component.

Reason for unavailability: %1.

The operation failed with error: %2.

Fields #

NameDescription
ErrorCode HexInt32The operation failed with error.
AvailabilityInfo UInt32Reason for unavailability.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Biometrics",
    "guid": "{A0E3D8EA-C34F-4419-A1DB-90435B8B21D0}",
    "event_source_name": "",
    "event_id": 1600,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T04:29:41.4351884+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 7288,
      "thread_id": 7420
    },
    "channel": "Microsoft-Windows-Biometrics/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x80070032"
  },
  "message": "The Windows Biometric Service failed to start its secure component.\r\rThe operation failed with error: 0x80070032."
}

Event ID 1601: The Windows Biometric Service successfully started its secure component.

#
Channel
Operational
Task
WBioSrvc

Event ID 1602: The Windows Biometric Service failed to migrate templates into Virtual Secure Mode.

#
Channel
Operational

Description

The Windows Biometric Service failed to migrate templates into Virtual Secure Mode.The operation failed with error: {ErrorCode}.

Message #

The Windows Biometric Service failed to migrate templates into Virtual Secure Mode.The operation failed with error: {ErrorCode}.

Fields #

NameDescription
ErrorCode

Event ID 1603: The Windows Biometric Service successfully migrated templates into Virtual Secure Mode.

#
Channel
Operational

Event ID 1604: The Windows Biometric Service secure component was compromised.

#
Channel
Operational

Description

The Windows Biometric Service secure component was compromised.The validation failed with error: {ErrorCode}.

Message #

The Windows Biometric Service secure component was compromised.The validation failed with error: {ErrorCode}.

Fields #

NameDescription
ErrorCode

Event ID 1605: The Windows Biometric Service secure component successfully authorized user Username (SID).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure component successfully authorized user %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1606: The Windows Biometric Service secure component successfully redeemed an authorization for user Username (SID).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure component successfully redeemed an authorization for user %2 (%1).

Fields #

NameDescription
SID UnicodeString
Username UnicodeString

Event ID 1607: The Windows Biometric Service secure componets successfully established a secure connection with sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure componets successfully established a secure connection with sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1608: The Windows Biometric Service secure componets successfully reestablished a secure connection with sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure componets successfully reestablished a secure connection with sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1609: The Windows Biometric Service secure component failed to establish a secure connection with sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure component failed to establish a secure connection with sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
ErrorCode HexInt32

Event ID 1610: The Windows Biometric Service secure component failed to delete an authorized enrollment for Username (SID) on sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure component failed to delete an authorized enrollment for %3 (%2) on sensor: %1.

The operation failed with error: %4.

Fields #

NameDescription
BiometricSensor UnicodeString
SID UnicodeString
Username UnicodeString
ErrorCode HexInt32

Event ID 1611: The Windows Biometric Service secure component successfully deleted an authorized enrollment for Username (SID) on sensor: BiometricSensor.

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service secure component successfully deleted an authorized enrollment for %3 (%2) on sensor: %1.

Fields #

NameDescription
BiometricSensor UnicodeString
SID UnicodeString
Username UnicodeString

Event ID 1700: The Windows Biometric Service successfully protected data for user SID (Type).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully protected data for user %2 (%1).

Type: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
Type UInt32

Event ID 1701: The Windows Biometric Service failed to protect data for user Username (SID).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to protect data for user %2 (%1).

Type: %3

The operation failed with error: %4.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
Type UInt32
ErrorCode HexInt32

Event ID 1702: The Windows Biometric Service successfully unprotected data for user SID (Type).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service successfully unprotected data for user %2 (%1).

Type: %3.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
Type UInt32

Event ID 1703: The Windows Biometric Service failed to unprotect data for user Username (SID).

#
Channel
Operational
Task
WBioSrvc

Message #

The Windows Biometric Service failed to unprotect data for user %2 (%1).

Type: %3

The operation failed with error: %4.

Fields #

NameDescription
SID UnicodeString
Username UnicodeString
Type UInt32
ErrorCode HexInt32

Event ID 7000: WBioSrvcStart

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7001: WBioSrvcStop

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7002: WBioSrvcStart7002

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7003: WBioSrvcStop7003

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7004: WBioSrvcStart7004

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7005: WBioSrvcStop7005

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7006: WBioSrvcStart7006

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7007: WBioSrvcStop7007

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7008: WBioSrvcStart7008

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7009: WBioSrvcStop7009

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7010: WBioSrvcStart7010

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7011: WBioSrvcStop7011

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Event ID 7012: WBioSrvcStart7012

#
Channel
Analytic
Task
WBioSrvc
Opcode
Start

Event ID 7013: WBioSrvcStop7013

#
Channel
Analytic
Task
WBioSrvc
Opcode
Stop

Provenance

ETW provider GUID a0e3d8ea-c34f-4419-a1db-90435b8b21d0

Defined in wbiosrvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB