Microsoft-Windows-CertificationAuthority-EnterprisePolicy

25 events across 1 channel

Event	Title	Channel	Sample
1113260059	Active Directory Certificate Services is configured to use LDAP referrals to …	Operational	N
1113325584	The {CertificateTemplateName} Certificate Template was loaded.	Operational	N
1113325585	The {CertificateTemplateName} Certificate Template requires …	Operational	N
2187001861	The Active Directory Certificate Services Policy contains no valid Certificate …	Operational	N
2187001882	Active Directory Certificate Services detected that LDAP referrals are enabled.	Operational	N
2187067399	The Enrollee ({EnrolleeName}) has no DNS name registered in the Active …	Operational	N
2187067400	The Enrollee ({EnrolleeName}) has no E-Mail name registered in the Active …	Operational	N
2187067405	The {CertificateTemplateName} Certificate Template could not be loaded.	Operational	N
2187067411	The certificate validity period will be shorter than the …	Operational	N
3260743684	Active Directory Certificate Services could not find required Active Directory …	Operational	N
3260743692	The Active Directory containing the Certification Authority could not be …	Operational	N
3260743701	Initialization failure loading information from the Active Directory containing …	Operational	N
3260743705	The requested validity period is invalid.	Operational	N
3260743709	The key archival request specified that it should not be persisted in the …	Operational	N
3260809225	The Enrollee was not able to successfully authenticate to the Certificate …	Operational	N
3260809226	The request was for a certificate template that is not supported by the Active …	Operational	N
3260809227	The request does not contain a certificate template extension or the …	Operational	N
3260809230	The request specifies conflicting certificate templates: {TemplateNames}.	Operational	N
3260809231	The Active Directory connection to {OldDSHostName} has been reestablished to …	Operational	N
3260809234	The {CertificateTemplateName} Certificate Template requires the following …	Operational	N
3260809236	Renewing a certificate with the {CertificateTemplateName} Certificate Template …	Operational	N
3260809238	The requester's Active Directory object is not in the current forest.	Operational	N
3260809239	The requester's Active Directory object could not be retrieved.	Operational	N
3260809240	Active Directory Certificate Services could not connect to the global catalog …	Operational	N
3260809244	An invalid OID has been detected in the EKUOIDsForVolatileRequests configuration …	Operational	N

Event ID 1113260059: Active Directory Certificate Services is configured to use LDAP referrals to request user data from the Active Directory directory service.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

Active Directory Certificate Services is configured to use LDAP referrals to request user data from the Active Directory directory service.

Message #

Active Directory Certificate Services is configured to use LDAP referrals to request user data from the Active Directory directory service.

Event ID 1113325584: The {CertificateTemplateName} Certificate Template was loaded.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The {CertificateTemplateName} Certificate Template was loaded.

Message #

The {CertificateTemplateName} Certificate Template was loaded.

Fields #

Name	Description
`CertificateTemplateName`

Event ID 1113325585: The {CertificateTemplateName} Certificate Template requires {RequiredSignatureCount} signatures; but only {AccepedSignatureCount} were accepted.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The {CertificateTemplateName} Certificate Template requires {RequiredSignatureCount} signatures; but only {AccepedSignatureCount} were accepted.

Message #

The {CertificateTemplateName} Certificate Template requires {RequiredSignatureCount} signatures; but only {AccepedSignatureCount} were accepted.

Fields #

Name	Description
`CertificateTemplateName`
`RequiredSignatureCount`
`AccepedSignatureCount`

Event ID 2187001861: The Active Directory Certificate Services Policy contains no valid Certificate Templates.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Active Directory Certificate Services Policy contains no valid Certificate Templates.

Message #

The Active Directory Certificate Services Policy contains no valid Certificate Templates.

Event ID 2187001882: Active Directory Certificate Services detected that LDAP referrals are enabled.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Message #

Active Directory Certificate Services detected that LDAP referrals are enabled. The current license of Windows does not allow LDAP referrals for Active Directory Certificate Services and this setting will be ignored. To disable LDAP referrals; open a command prompt window; type: certutil -setreg policy\EditFlags -EDITF_ENABLELDAPREFERRALS and press Enter and restart the CA.

Event ID 2187067399: The Enrollee ({EnrolleeName}) has no DNS name registered in the Active Directory.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Enrollee ({EnrolleeName}) has no DNS name registered in the Active Directory. The certificate cannot be generated.

Message #

The Enrollee ({EnrolleeName}) has no DNS name registered in the Active Directory. The certificate cannot be generated.

Fields #

Name	Description
`EnrolleeName`

Event ID 2187067400: The Enrollee ({EnrolleeName}) has no E-Mail name registered in the Active Directory.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Enrollee ({EnrolleeName}) has no E-Mail name registered in the Active Directory. The E-Mail name will not be included in the certificate.

Message #

The Enrollee ({EnrolleeName}) has no E-Mail name registered in the Active Directory.  The E-Mail name will not be included in the certificate.

Fields #

Name	Description
`EnrolleeName`

Event ID 2187067405: The {CertificateTemplateName} Certificate Template could not be loaded.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The {CertificateTemplateName} Certificate Template could not be loaded. {ErrorCode}.

Message #

The {CertificateTemplateName} Certificate Template could not be loaded.  {ErrorCode}.

Fields #

Name	Description
`CertificateTemplateName`
`ErrorCode`

Event ID 2187067411: The certificate validity period will be shorter than the {CertificateTemplateName} Certificate Template specifies; because the template validity pe...

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Message #

The certificate validity period will be shorter than the {CertificateTemplateName} Certificate Template specifies; because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate; reducing the template validity period; or increasing the registry validity period.

Fields #

Name	Description
`CertificateTemplateName`

Event ID 3260743684: Active Directory Certificate Services could not find required Active Directory information.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

Active Directory Certificate Services could not find required Active Directory information.

Message #

Active Directory Certificate Services could not find required Active Directory information.

Event ID 3260743692: The Active Directory containing the Certification Authority could not be contacted.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Active Directory containing the Certification Authority could not be contacted.

Message #

The Active Directory containing the Certification Authority could not be contacted.

Event ID 3260743701: Initialization failure loading information from the Active Directory containing the Certification Authority.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

Initialization failure loading information from the Active Directory containing the Certification Authority.

Message #

Initialization failure loading information from the Active Directory containing the Certification Authority.

Event ID 3260743705: The requested validity period is invalid.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Message #

The requested validity period is invalid. Confirm that the validity period or expiration date and time specified in the request does not extend beyond the validity period of the CA certificate; the certificate template; and the CA. The validity period of the CA can be verified by running the following commands: certutil -getreg ca\validityPeriod & certutil -getreg ca\ValdityPeriodUnits.

Event ID 3260743709: The key archival request specified that it should not be persisted in the database.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The key archival request specified that it should not be persisted in the database. Key Archival requests must always be persisted.

Message #

The key archival request specified that it should not be persisted in the database. Key Archival requests must always be persisted.

Event ID 3260809225: The Enrollee was not able to successfully authenticate to the Certificate Service.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Enrollee was not able to successfully authenticate to the Certificate Service. Please check your security settings.

Message #

The Enrollee was not able to successfully authenticate to the Certificate Service.  Please check your security settings.

Event ID 3260809226: The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: {CertificateTemplateName}.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: {CertificateTemplateName}.

Message #

The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: {CertificateTemplateName}.

Fields #

Name	Description
`CertificateTemplateName`

Event ID 3260809227: The request does not contain a certificate template extension or the {RequestAttributeName} request attribute.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The request does not contain a certificate template extension or the {RequestAttributeName} request attribute.

Message #

The request does not contain a certificate template extension or the {RequestAttributeName} request attribute.

Fields #

Name	Description
`RequestAttributeName`

Event ID 3260809230: The request specifies conflicting certificate templates: {TemplateNames}.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The request specifies conflicting certificate templates: {TemplateNames}.

Message #

The request specifies conflicting certificate templates: {TemplateNames}.

Fields #

Name	Description
`TemplateNames`

Event ID 3260809231: The Active Directory connection to {OldDSHostName} has been reestablished to {NewDSHostName}.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The Active Directory connection to {OldDSHostName} has been reestablished to {NewDSHostName}.

Message #

The Active Directory connection to {OldDSHostName} has been reestablished to {NewDSHostName}.

Fields #

Name	Description
`OldDSHostName`
`NewDSHostName`

Event ID 3260809234: The {CertificateTemplateName} Certificate Template requires the following issuance policies that signing certificates did not include: {MissingIssu...

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The {CertificateTemplateName} Certificate Template requires the following issuance policies that signing certificates did not include: {MissingIssuancePolicyOIDsInSigningCertificate}.

Message #

The {CertificateTemplateName} Certificate Template requires the following issuance policies that signing certificates did not include: {MissingIssuancePolicyOIDsInSigningCertificate}.

Fields #

Name	Description
`CertificateTemplateName`
`MissingIssuancePolicyOIDsInSigningCertificate`

Event ID 3260809236: Renewing a certificate with the {CertificateTemplateName} Certificate Template failed because the renewal overlap period is longer than the certifi...

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

Renewing a certificate with the {CertificateTemplateName} Certificate Template failed because the renewal overlap period is longer than the certificate validity period.

Message #

Renewing a certificate with the {CertificateTemplateName} Certificate Template failed because the renewal overlap period is longer than the certificate validity period.

Fields #

Name	Description
`CertificateTemplateName`

Event ID 3260809238: The requester's Active Directory object is not in the current forest.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The requester's Active Directory object is not in the current forest. Cross forest enrollment is not enabled. {RequesterName} {ErrorCode}.

Message #

The requester's Active Directory object is not in the current forest.  Cross forest enrollment is not enabled.  {RequesterName}  {ErrorCode}

Fields #

Name	Description
`RequesterName`
`ErrorCode`

Event ID 3260809239: The requester's Active Directory object could not be retrieved.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

The requester's Active Directory object could not be retrieved. {RequesterName} {ErrorCode}.

Message #

The requester's Active Directory object could not be retrieved.  {RequesterName}  {ErrorCode}

Fields #

Name	Description
`RequesterName`
`ErrorCode`

Event ID 3260809240: Active Directory Certificate Services could not connect to the global catalog server.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Description

Active Directory Certificate Services could not connect to the global catalog server. {RequesterName} {ErrorCode}.

Message #

Active Directory Certificate Services could not connect to the global catalog server.  {RequesterName}  {ErrorCode}

Fields #

Name	Description
`RequesterName`
`ErrorCode`

Event ID 3260809244: An invalid OID has been detected in the EKUOIDsForVolatileRequests configuration setting.

Provider: Microsoft-Windows-CertificationAuthority-EnterprisePolicy
Channel: Operational

Message #

An invalid OID has been detected in the EKUOIDsForVolatileRequests configuration setting. To resolve; run: 'certutil -getreg policy\EKUOIDsForVolatileRequests' to identify the invalid OID and correct it.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)