Microsoft-Windows-CertificateServicesClient-AutoEnrollment

Event	Title	Channel	Sample	Rule
1	Automatic certificate enrollment for Context failed to download certificates for …	Operational	N	N
2	Automatic certificate enrollment for Context started	Operational	N	N
3	Automatic certificate enrollment for Context completed	Operational	N	N
4	Automatic certificate enrollment for Context invoked the enrollment API	Operational	N	N
5	Automatic certificate enrollment for Context returned from the enrollment API	Operational	N	N
6	Automatic certificate enrollment for local system failed (0x8007054b) The …	Application	Y	N
6	Automatic certificate enrollment for Context failed (ErrorCode)	Operational	N	N
15	Automatic certificate enrollment for Context failed to contact the active …	Operational	N	N
64	Certificate for Context with Thumbprint ObjId is about to expire or already …	Operational	N	N
1073741825	Automatic certificate enrollment for Context failed to download certificates for …	Operational	N	N
1073741826	Automatic certificate enrollment for {Context} started.	Operational	N	N
1073741827	Automatic certificate enrollment for {Context} completed.	Operational	N	N
1073741828	Automatic certificate enrollment for {Context} invoked the enrollment API.	Operational	N	N
1073741829	Automatic certificate enrollment for {Context} returned from the enrollment API.	Operational	N	N
1073741830	Automatic certificate enrollment for Context failed (ErrorCode) ErrorMsg.	Operational	N	N
2147483663	Automatic certificate enrollment for Context failed to contact the active …	Operational	N	N
2147483712	Certificate for Context with Thumbprint ObjId is about to expire or already …	Operational	N	N
3221225473	Automatic certificate enrollment for {Context} failed to download certificates …	Operational	N	N
3221225474	Automatic certificate enrollment for Context started.	Operational	N	N
3221225475	Automatic certificate enrollment for Context completed.	Operational	N	N
3221225476	Automatic certificate enrollment for Context invoked the enrollment API.	Operational	N	N
3221225477	Automatic certificate enrollment for Context returned from the enrollment API.	Operational	N	N
3221225478	Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.	Operational	N	N

Event ID 1: Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode)

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`StoreName` UnicodeString
`LdapStore` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2: Automatic certificate enrollment for Context started

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 3: Automatic certificate enrollment for Context completed

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 4: Automatic certificate enrollment for Context invoked the enrollment API

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 5: Automatic certificate enrollment for Context returned from the enrollment API

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString

Event ID 6: Automatic certificate enrollment for local system failed (0x8007054b) The specified domain either does not exist or could not be contacted.

Channel: Application
Level: Error

Fields #

Name	Description
`Context`
`ErrorCode`
`ErrorMsg`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertificateServicesClient-AutoEnrollment",
    "guid": "{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}",
    "event_source_name": "AutoEnrollment",
    "event_id": 6,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T08:15:12.653840+00:00",
    "event_record_id": 112,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "local system",
    "ErrorCode": "0x8007054b",
    "ErrorMsg": "The specified domain either does not exist or could not be contacted.\r\n"
  },
  "message": "Automatic certificate enrollment for local system failed (0x8007054b) The specified domain either does not exist or could not be contacted.\r\n."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 6: Automatic certificate enrollment for Context failed (ErrorCode)

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 15: Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode)

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 64: Certificate for Context with Thumbprint ObjId is about to expire or already expired

Channel: Operational

Fields #

Name	Description
`Context` UnicodeString
`ObjId` UnicodeString

Event ID 1073741825: Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode).

Channel: Operational

Description

Automatic certificate enrollment for Context failed to download certificates for StoreName store from LdapStore (ErrorCode). ErrorMsg.

Message #

Automatic certificate enrollment for %1 failed to download certificates for %2 store from %3 (%4). %5

Fields #

Name	Description
`Context` UnicodeString	Automatic certificate enrollment for
`StoreName` UnicodeString	failed to download certificates for
`LdapStore` UnicodeString	store from
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 1073741826: Automatic certificate enrollment for {Context} started.

Channel: Operational

Fields #

Name	Description
`Context`

Event ID 1073741827: Automatic certificate enrollment for {Context} completed.

Channel: Operational

Fields #

Name	Description
`Context`

Event ID 1073741828: Automatic certificate enrollment for {Context} invoked the enrollment API.

Channel: Operational

Fields #

Name	Description
`Context`

Event ID 1073741829: Automatic certificate enrollment for {Context} returned from the enrollment API.

Channel: Operational

Fields #

Name	Description
`Context`

Event ID 1073741830: Automatic certificate enrollment for Context failed (ErrorCode) ErrorMsg.

Channel: Operational

Message #

Automatic certificate enrollment for %1 failed (%2) %3.

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2147483663: Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode).

Channel: Operational

Description

Automatic certificate enrollment for Context failed to contact the active directory (ErrorCode). ErrorMsg Enrollment will not be performed.

Message #

Automatic certificate enrollment for %1 failed to contact the active directory (%2). %3 Enrollment will not be performed.

Fields #

Name	Description
`Context` UnicodeString
`ErrorCode` UnicodeString
`ErrorMsg` UnicodeString

Event ID 2147483712: Certificate for Context with Thumbprint ObjId is about to expire or already expired.

Channel: Operational

Message #

Certificate for %1 with Thumbprint %2 is about to expire or already expired.

Fields #

Name	Description
`Context` UnicodeString
`ObjId` UnicodeString

Event ID 3221225473: Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}).

Channel: Operational

Description

Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}). {ErrorMsg}.

Message #

Automatic certificate enrollment for {Context} failed to download certificates for {StoreName} store from {LdapStore} ({ErrorCode}). {ErrorMsg}

Fields #

Name	Description
`Context`
`StoreName`
`LdapStore`
`ErrorCode`
`ErrorMsg`

Event ID 3221225474: Automatic certificate enrollment for Context started.

Channel: Operational

Message #

Automatic certificate enrollment for %1 started.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225475: Automatic certificate enrollment for Context completed.

Channel: Operational

Message #

Automatic certificate enrollment for %1 completed.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225476: Automatic certificate enrollment for Context invoked the enrollment API.

Channel: Operational

Message #

Automatic certificate enrollment for %1 invoked the enrollment API.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225477: Automatic certificate enrollment for Context returned from the enrollment API.

Channel: Operational

Message #

Automatic certificate enrollment for %1 returned from the enrollment API.

Fields #

Name	Description
`Context` UnicodeString

Event ID 3221225478: Automatic certificate enrollment for {Context} failed ({ErrorCode}) {ErrorMsg}.

Channel: Operational

Fields #

Name	Description
`Context`
`ErrorCode`
`ErrorMsg`

Provenance

ETW provider GUID f0db7ef8-b6f3-4005-9937-feb77b9e1b43

Defined in pautoenr.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB