Microsoft-Windows-Biometrics
90 events across 2 channels
Event ID 1000: The Windows Biometric Service could not verify Username (SID) using sensor: BiometricSensor.
#Description
The Windows Biometric Service could not verify Username (SID) using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString | |
ErrorCode HexInt32 |
Event ID 1001: The Windows Biometric Service successfully verified Username (SID) using sensor: BiometricSensor.
#Description
The Windows Biometric Service successfully verified Username (SID) using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString |
Event ID 1002: The Windows Biometric Service could not match Username (SID) with the sample from sensor: BiometricSensor.
#Description
The Windows Biometric Service could not match Username (SID) with the sample from sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString |
Event ID 1003: The Windows Biometric Service could not complete an identification operation using sensor: BiometricSensor.
#Description
The Windows Biometric Service could not complete an identification operation using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1004: The Windows Biometric Service successfully identified Username (SID) using sensor: BiometricSensor.
#Description
The Windows Biometric Service successfully identified Username (SID) using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString |
Event ID 1005: The Windows Biometric Service could not determine the identity of the sample from sensor: BiometricSensor.
#Description
The Windows Biometric Service could not determine the identity of the sample from sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString |
Event ID 1006: The Windows Biometric Service started an enrollment operation using sensor: BiometricSensor.
#Description
The Windows Biometric Service started an enrollment operation using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString |
Event ID 1007: The Windows Biometric Service encountered an error while processing and updating an enrollment request using sensor: BiometricSensor.
#Description
The Windows Biometric Service encountered an error while processing and updating an enrollment request using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1008: The Windows Biometric Service is processing an enrollment operation and updating an enrollment using sensor: BiometricSensor.
#Description
The Windows Biometric Service is processing an enrollment operation and updating an enrollment using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString |
Event ID 1009: The Windows Biometric Service failed to enroll Username (SID) using sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to enroll Username (SID) using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString | |
ErrorCode HexInt32 |
Event ID 1010: The Windows Biometric Service successfully enrolled Username (SID) using sensor: BiometricSensor.
#Description
The Windows Biometric Service successfully enrolled Username (SID) using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString |
Event ID 1011: The Windows Biometric Service failed to begin a capture operation using sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to begin a capture operation using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1012: The Windows Biometric Service failed to complete a capture operation using sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to complete a capture operation using sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 | |
RejectDetail UInt32 |
Event ID 1013: The Windows Biometric Service failed to export data from sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to export data from sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1014: The Windows Biometric Service failed to delete a database record for Username (SID) on sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to delete a database record for Username (SID) on sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString | |
ErrorCode HexInt32 |
Event ID 1015: The Windows Biometric Service successfully deleted a database record for Username (SID) on sensor: BiometricSensor.
#Description
The Windows Biometric Service successfully deleted a database record for Username (SID) on sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
SID UnicodeString | |
Username UnicodeString |
Event ID 1016: The Windows Biometric Service failed to complete a vendor-specific operation for sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to complete a vendor-specific operation for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ControlCode HexInt32 | |
OperationStatus HexInt32 | NTSTATUS reference |
ErrorCode HexInt32 |
Event ID 1017: The Windows Biometric Service completed a vendor-specific operation for sensor: BiometricSensor.
#Description
The Windows Biometric Service completed a vendor-specific operation for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ControlCode HexInt32 | |
OperationStatus HexInt32 | NTSTATUS reference |
Event ID 1018: The Windows Biometric Service failed to complete a privileged vendor-specific operation for sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to complete a privileged vendor-specific operation for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ControlCode HexInt32 | |
OperationStatus HexInt32 | NTSTATUS reference |
ErrorCode HexInt32 |
Event ID 1019: The Windows Biometric Service completed a privileged vendor-specific operation for sensor: BiometricSensor.
#Description
The Windows Biometric Service completed a privileged vendor-specific operation for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ControlCode HexInt32 | |
OperationStatus HexInt32 | NTSTATUS reference |
Event ID 1020: The Windows Biometric Service cannot complete a request because biometric operations are disabled by current system policy.
#Description
The Windows Biometric Service cannot complete a request because biometric operations are disabled by current system policy.
Message #
Event ID 1021: The Windows Biometric Service cannot complete a request because Terminal Server client sessions are not allowed to access the System sensor pool.
#Description
The Windows Biometric Service cannot complete a request because Terminal Server client sessions are not allowed to access the System sensor pool.
Message #
Event ID 1100: The Windows Biometric Service failed to load an adapter binary: ModulePath.
#Event ID 1101: The Windows Biometric Service failed to load an adapter binary: ModulePath.
#Event ID 1102: The Windows Biometric Service failed to load an adapter binary: ModulePath.
#Event ID 1103: The Windows Biometric Service failed to open sensor: BiometricSensor.
#Event ID 1104: The Windows Biometric Service failed to set the mode of sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to set the mode of sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1105: The Windows Biometric Service failed to initialize an adapter binary: BiometricSensor.
#Description
The Windows Biometric Service failed to initialize an adapter binary: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ErrorCode HexInt32 |
Event ID 1106: The Windows Biometric Service detected a missing or invalid biometric database configuration for sensor: BiometricSensor.
#Description
The Windows Biometric Service detected a missing or invalid biometric database configuration for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1107: The Windows Biometric Service encountered an error while opening the database associated with sensor: BiometricSensor.
#Description
The Windows Biometric Service encountered an error while opening the database associated with sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1108: The Windows Biometric Service successfully created a Biometric Unit for sensor: BiometricSensor.
#Description
The Windows Biometric Service successfully created a Biometric Unit for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | The Windows Biometric Service successfully created a Biometric Unit for sensor. |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Biometrics",
"guid": "{A0E3D8EA-C34F-4419-A1DB-90435B8B21D0}",
"event_source_name": "",
"event_id": 1108,
"version": 0,
"level": 5,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T04:29:41.5895906+00:00",
"event_record_id": 8,
"correlation": {},
"execution": {
"process_id": 7288,
"thread_id": 7420
},
"channel": "Microsoft-Windows-Biometrics/Operational",
"computer": "telemetry-DC-d.cell-d.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"BiometricSensor": "Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})",
"SensorAdapter": "NUIVoiceWBSAdapters.dll",
"EngineAdapter": "NUIVoiceWBSAdapters.dll",
"StorageAdapter": "WinBioStorageAdapter.dll",
"DatabaseID": "{51f39552-1075-4199-b513-0c10ea185db0}",
"SensorMode": "1",
"SensorPool": "1",
"IsolationLevel": "0",
"IsolationSensorAdapter": "-",
"IsolationEngineAdapter": "-",
"IsolationStorageAdapter": "-"
},
"message": "The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\r\rThe sensor's mode is \"Basic,\" its pool-type is \"System,\" and it's isolated in a \"Local System\" process.\r\rSee the \"Details\" pane for additional information about the sensor's new configuration."
}
Event ID 1109: The Windows Biometric Service failed to configure a Biometric Unit for sensor: BiometricSensor.
#Description
The Windows Biometric Service failed to configure a Biometric Unit for sensor: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
ErrorCode HexInt32 |
Event ID 1110: The Windows Biometric Service failed to create a Biometric Unit for sensor: BiometricSensor.
#Event ID 1111: The Windows Biometric Service failed to create a Biometric Unit for sensor: BiometricSensor.
#Event ID 1112: The Windows Biometric Service failed to complete the calibration setup protocol: BiometricSensor.
#Description
The Windows Biometric Service failed to complete the calibration setup protocol: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ErrorCode HexInt32 |
Event ID 1113: The Windows Biometric Service failed to load an adapter binary: ModulePath.
#Event ID 1114: The Windows Biometric Service failed to transfer private sensor type information to the matching engine: BiometricSensor.
#Description
The Windows Biometric Service failed to transfer private sensor type information to the matching engine: BiometricSensor.
Message #
Fields #
| Name | Description |
|---|---|
BiometricSensor UnicodeString | |
SensorAdapter UnicodeString | |
EngineAdapter UnicodeString | |
StorageAdapter UnicodeString | |
DatabaseID GUID | |
SensorMode UInt32 | |
SensorPool UInt32 | |
IsolationLevel UInt32 | |
IsolationSensorAdapter UnicodeString | |
IsolationEngineAdapter UnicodeString | |
IsolationStorageAdapter UnicodeString | |
Component UInt32 | |
ErrorCode HexInt32 |
Event ID 1115: The Windows Biometric Service's Source policy configuration.
#Event ID 1116: The Windows Biometric Service's ESS state configuration.
#Description
The Windows Biometric Service's ESS state configuration.
Message #
Fields #
| Name | Description |
|---|---|
requiresTPM Boolean | |
isVBSCapable Boolean | |
hasNonVBSWindowsHello Boolean | |
hasVBSWindowsHello Boolean | |
requiresVBSRunning Boolean | |
requiresVBSEncryptionKeys Boolean | |
requiresEnablement Boolean | |
managedByPolicy Boolean | |
hasNonVBSBiometricEnrollments Boolean | |
hasVBSBiometricEnrollments Boolean | |
hasESSFaceSensor Boolean | |
hasESSFprSensor Boolean | |
requiresIsolatedProcess Boolean | |
hasBlockedNonESSFpr Boolean | |
hasBlockedNonESSCamera Boolean | |
isDeviceEssSourceDefault Boolean |
Event ID 1400: The Windows Fingerprint Credential Provider could not log Username on because the stored credential was invalid.
#Event ID 1401: The Windows Fingerprint Credential Provider failed to enumerate its tile.
#Event ID 1402: The Windows Fingerprint Credential Provider could not log Username on because the user does not have a credential stored for biometric logon.
#Event ID 1403: The Windows Fingerprint Credential Provider has disabled biometric authentication.
#Event ID 1500: The Windows Biometric Credential Manager successfully stored a credential for Username (SID).
#Event ID 1501: The Windows Biometric Credential Manager failed to store a credential for Username (SID) due to the caller having insufficient privileges.
#Event ID 1502: The Windows Biometric Credential Manager failed to store a credential because the Windows Fingerprint Credential Provider is disabled.
#Description
The Windows Biometric Credential Manager failed to store a credential because the Windows Fingerprint Credential Provider is disabled.
Message #
Event ID 1503: The Windows Biometric Credential Manager failed to store a credential.
#Event ID 1504: The Windows Biometric Credential Manager successfully removed a credential for Username (SID).
#Event ID 1505: The Windows Biometric Credential Manager failed to remove a credential for Username (SID) due to the caller having insufficient privileges.
#Event ID 1506: The Windows Biometric Credential Manager failed to remove a credential because the Windows Fingerprint Credential Provider is disabled.
#Description
The Windows Biometric Credential Manager failed to remove a credential because the Windows Fingerprint Credential Provider is disabled.
Message #
Event ID 1507: The Windows Biometric Credential Manager failed to remove a credential.
#Event ID 1508: The Windows Biometric Credential Manager successfully retrieved the credential state for Username (SID).
#Event ID 1509: The Windows Biometric Credential Manager failed to retrieve the credential state for Username (SID) due to the caller having insufficient privileges.
#Event ID 1510: The Windows Biometric Credential Manager failed to retrieve the credential state because the Windows Fingerprint Credential Provider is disabled.
#Description
The Windows Biometric Credential Manager failed to retrieve the credential state because the Windows Fingerprint Credential Provider is disabled.
Message #
Event ID 1511: The Windows Biometric Credential Manager failed to retrieve the state of a credential.
#Event ID 1512: The Windows Biometric Credential Manager successfully switched to user Username (SID).
#Event ID 1513: The Windows Biometric Credential Manager failed to switch to user Username (SID) due to the caller having insufficient privileges.
#Event ID 1514: The Windows Biometric Credential Manager failed to switch to the specified user because the Windows Fingerprint Credential Provider is disabled.
#Description
The Windows Biometric Credential Manager failed to switch to the specified user because the Windows Fingerprint Credential Provider is disabled.
Message #
Event ID 1515: The Windows Biometric Credential Manager failed to switch to user Username (SID) because they are already the interactive user.
#Event ID 1516: The Windows Biometric Credential Manager failed to switch to the specified user.
#Event ID 1600: The Windows Biometric Service failed to start its secure component.
#Description
The Windows Biometric Service failed to start its secure component.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | The operation failed with error. |
AvailabilityInfo UInt32 | Reason for unavailability. |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Biometrics",
"guid": "{A0E3D8EA-C34F-4419-A1DB-90435B8B21D0}",
"event_source_name": "",
"event_id": 1600,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T04:29:41.4351884+00:00",
"event_record_id": 7,
"correlation": {},
"execution": {
"process_id": 7288,
"thread_id": 7420
},
"channel": "Microsoft-Windows-Biometrics/Operational",
"computer": "telemetry-DC-d.cell-d.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"ErrorCode": "0x80070032"
},
"message": "The Windows Biometric Service failed to start its secure component.\r\rThe operation failed with error: 0x80070032."
}
Event ID 1601: The Windows Biometric Service successfully started its secure component.
#Description
The Windows Biometric Service successfully started its secure component.
Message #
Event ID 1602: The Windows Biometric Service failed to migrate templates into Virtual Secure Mode.
#Event ID 1603: The Windows Biometric Service successfully migrated templates into Virtual Secure Mode.
#Description
The Windows Biometric Service successfully migrated templates into Virtual Secure Mode.
Message #
Event ID 1604: The Windows Biometric Service secure component was compromised.
#Event ID 1605: The Windows Biometric Service secure component successfully authorized user Username (SID).
#Event ID 1606: The Windows Biometric Service secure component successfully redeemed an authorization for user Username (SID).
#Event ID 1607: The Windows Biometric Service secure componets successfully established a secure connection with sensor: BiometricSensor.
#Event ID 1608: The Windows Biometric Service secure componets successfully reestablished a secure connection with sensor: BiometricSensor.
#Event ID 1609: The Windows Biometric Service secure component failed to establish a secure connection with sensor: BiometricSensor.
#Event ID 1610: The Windows Biometric Service secure component failed to delete an authorized enrollment for Username (SID) on sensor: BiometricSensor.
#Event ID 1611: The Windows Biometric Service secure component successfully deleted an authorized enrollment for Username (SID) on sensor: BiometricSensor.
#Event ID 1700: The Windows Biometric Service successfully protected data for user SID (Type).
#Event ID 1701: The Windows Biometric Service failed to protect data for user Username (SID).
#Event ID 1702: The Windows Biometric Service successfully unprotected data for user SID (Type).
#Event ID 1703: The Windows Biometric Service failed to unprotect data for user Username (SID).
#Event ID 7000: WBioSrvcStart
#Event ID 7001: WBioSrvcStop
#Event ID 7002: WBioSrvcStart7002
#Event ID 7003: WBioSrvcStop7003
#Event ID 7004: WBioSrvcStart7004
#Event ID 7005: WBioSrvcStop7005
#Event ID 7006: WBioSrvcStart7006
#Event ID 7007: WBioSrvcStop7007
#Event ID 7008: WBioSrvcStart7008
#Event ID 7009: WBioSrvcStop7009
#Event ID 7010: WBioSrvcStart7010
#Event ID 7011: WBioSrvcStop7011
#Event ID 7012: WBioSrvcStart7012
#Event ID 7013: WBioSrvcStop7013
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID a0e3d8ea-c34f-4419-a1db-90435b8b21d0
Defined in wbiosrvc.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02