detection.wiki

Microsoft-Windows-CertPolEng

EventTitleChannelSampleRule
0Entering Function FunctionName.OperationalYN
1Exiting Function FunctionName.OperationalYN
2FunctionName failed with return code LastError.OperationalYN
3FunctionName returned LastError.OperationalNN
4Not running inside LSAOperationalNN
5Running inside LSAOperationalYN
6Cert Store changes are detectedOperationalNN
7No online providers are installedOperationalNN
8There are no trust anchors for the providersOperationalNN
9Total number of TrustRoot Found Number.OperationalNN
10Target name is TargetName, HostName is HostName.OperationalNN
11PSTGetCertificate called, number of select criteria are NumOfCriteria, bIsClient …OperationalNN
12Opening Machine Store?OperationalNN
13Expired cert foundOperationalNN
14Unable to find Provider From Certificate: Error LastError.OperationalNN
15Calling LRPC cert renewal Interface psz.OperationalNN
16Expired Certificate were found, will call CertSelectCertificateChains againOperationalNN
17No matching Certificate were foundOperationalNN
18Will Special case for Homegroup self sign certificatesOperationalNN
19GetCertificates returning Number certificates.OperationalNN
20RequestIssuancePolicy Is SpecifiedOperationalNN
21Certificate is Self SignedOperationalNN
22Certificate found in HomeGroup ContainerOperationalNN
23Checking if the Certificate is from one of the ProvidersOperationalNN
24Cert Subject name is psz.OperationalNN
25UserName is psz.OperationalNN
26Failed to Connect to psz.OperationalNN
27CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider …OperationalNN
28Failed to Open Provider Root Key Number.OperationalNN
29Failed to Query Provider Root Key Number.OperationalNN
30Failed to Query SubKey SubKey, Error LastError.OperationalNN
31Invalid Provider GUID SubKey.OperationalNN
32CertVerifyCertificateChainPolicy Failed Status is LastError, ChainIndex …OperationalNN
33Failed to open LSA Registry Root Key Number.OperationalNN
34Pku2u is disabled by policyOperationalYN
35Failed to open StoreName certificate store.OperationalNN
36Failed to validate certificate.OperationalNN
37Failed to validate certificate.OperationalNN
38UPN and client RDN are missingOperationalNN
39The client name doesn't match the UPN.OperationalNN
40The client name is psz.OperationalNN
41The client name matched the UPN.OperationalNN
42Certificate validation succeeded as the hash comparison succeededOperationalNN
43Unable to find the certificate in the HomeGroup ContainerOperationalNN
44The certificate chains to an untrusted rootOperationalNN
45The supplied or saved credman credential with username UserName is not a UPN.OperationalYN
46Provider Provider is not enabled.OperationalYN
47Failed for Certificate …OperationalNN

Event ID 0: Entering Function FunctionName.

#
Channel
Operational
Also via
realtime ETW trace
Level
Informational
Opcode
Info

Message #

Entering Function %1

Fields #

NameDescription
FunctionName AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524244+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "IntPstGetTrustAnchors"
  },
  "message": ""
}

Event ID 1: Exiting Function FunctionName.

#
Channel
Operational
Also via
realtime ETW trace
Level
Informational
Opcode
Info

Message #

Exiting Function %1

Fields #

NameDescription
FunctionName AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524262+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "CProviderRegistrationCache::IntGetTrustAnchors"
  },
  "message": ""
}

Event ID 2: FunctionName failed with return code LastError.

#
Channel
Operational
Also via
realtime ETW trace
Level
Error
Opcode
Info

Message #

%1 failed with return code %2

Fields #

NameDescription
FunctionName AnsiString
LastError UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524258+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "IntGetTrustAnchors(actual error)",
    "LastError": 3221685484
  },
  "message": ""
}

Event ID 3: FunctionName returned LastError.

#
Channel
Operational
Opcode
Info

Message #

%1 returned %2

Fields #

NameDescription
FunctionName AnsiString
LastError UInt32

Event ID 4: Not running inside LSA

#
Channel
Operational
Opcode
Info

Event ID 5: Running inside LSA

#
Channel
Operational
Level
Informational
Opcode
Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-14T16:28:40.910557+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "0DD0D01B-52DE-45C4-BB8D-BF1723FA1D6F"
    },
    "execution": {
      "process_id": 1092,
      "thread_id": 3352
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 6: Cert Store changes are detected

#
Channel
Operational
Opcode
Info

Event ID 7: No online providers are installed

#
Channel
Operational
Opcode
Info

Event ID 8: There are no trust anchors for the providers

#
Channel
Operational
Opcode
Info

Event ID 9: Total number of TrustRoot Found Number.

#
Channel
Operational
Opcode
Info

Message #

Total number of TrustRoot Found %1

Fields #

NameDescription
Number UInt32

Event ID 10: Target name is TargetName, HostName is HostName.

#
Channel
Operational
Opcode
Info

Message #

Target name is %1, HostName is %2

Fields #

NameDescription
TargetName UnicodeString
HostName UnicodeString

Event ID 11: PSTGetCertificate called, number of select criteria are NumOfCriteria, bIsClient parameter is bClient.

#
Channel
Operational
Opcode
Info

Message #

PSTGetCertificate called, number of select criteria are %1, bIsClient parameter is %2

Fields #

NameDescription
NumOfCriteria UInt32
bClient Boolean

Event ID 12: Opening Machine Store?

#
Channel
Operational
Opcode
Info

Description

Opening Machine Store? Value: Opening_Machine_Store_Value.

Message #

Opening Machine Store? Value: %1

Fields #

NameDescription
Number UInt32

Event ID 13: Expired cert found

#
Channel
Operational
Opcode
Info

Event ID 14: Unable to find Provider From Certificate: Error LastError.

#
Channel
Operational
Opcode
Info

Message #

Unable to find Provider From Certificate: Error %1

Fields #

NameDescription
LastError UInt32

Event ID 15: Calling LRPC cert renewal Interface psz.

#
Channel
Operational
Opcode
Info

Message #

Calling LRPC cert renewal Interface %1

Fields #

NameDescription
psz UnicodeString

Event ID 16: Expired Certificate were found, will call CertSelectCertificateChains again

#
Channel
Operational
Opcode
Info

Event ID 17: No matching Certificate were found

#
Channel
Operational
Opcode
Info

Event ID 18: Will Special case for Homegroup self sign certificates

#
Channel
Operational
Opcode
Info

Event ID 19: GetCertificates returning Number certificates.

#
Channel
Operational
Opcode
Info

Message #

GetCertificates returning %1 certificates

Fields #

NameDescription
Number UInt32

Event ID 20: RequestIssuancePolicy Is Specified

#
Channel
Operational
Opcode
Info

Event ID 21: Certificate is Self Signed

#
Channel
Operational
Opcode
Info

Event ID 22: Certificate found in HomeGroup Container

#
Channel
Operational
Opcode
Info

Event ID 23: Checking if the Certificate is from one of the Providers

#
Channel
Operational
Opcode
Info

Event ID 24: Cert Subject name is psz.

#
Channel
Operational
Opcode
Info

Message #

Cert Subject name is %1

Fields #

NameDescription
psz UnicodeString

Event ID 25: UserName is psz.

#
Channel
Operational
Opcode
Info

Message #

UserName is %1

Fields #

NameDescription
psz UnicodeString

Event ID 26: Failed to Connect to psz.

#
Channel
Operational
Opcode
Info

Message #

Failed to Connect to %1

Fields #

NameDescription
psz UnicodeString

Event ID 27: CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider Provider.

#
Channel
Operational
Opcode
Info

Description

CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider Provider. Error code LastError.

Message #

CProviderEntry::ReadInfoFromRegistry LRPC Entrypoint is missing for provider %1. Error code %2

Fields #

NameDescription
Provider GUID
LastError UInt32

Event ID 28: Failed to Open Provider Root Key Number.

#
Channel
Operational
Opcode
Info

Message #

Failed to Open Provider Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 29: Failed to Query Provider Root Key Number.

#
Channel
Operational
Opcode
Info

Message #

Failed to Query Provider Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 30: Failed to Query SubKey SubKey, Error LastError.

#
Channel
Operational
Opcode
Info

Message #

Failed to Query SubKey %1, Error %2

Fields #

NameDescription
SubKey UInt32
LastError UInt32

Event ID 31: Invalid Provider GUID SubKey.

#
Channel
Operational
Opcode
Info

Description

Invalid Provider GUID SubKey. LastError.

Message #

Invalid Provider GUID %1. %2

Fields #

NameDescription
SubKey UnicodeString
LastError UInt32

Event ID 32: CertVerifyCertificateChainPolicy Failed Status is LastError, ChainIndex ChainIndex, lElementIndex lElementIndex.

#
Channel
Operational
Opcode
Info

Message #

CertVerifyCertificateChainPolicy Failed Status is %1, ChainIndex %2, lElementIndex %3

Fields #

NameDescription
LastError UInt32
ChainIndex UInt32
lElementIndex UInt32

Event ID 33: Failed to open LSA Registry Root Key Number.

#
Channel
Operational
Opcode
Info

Message #

Failed to open LSA Registry Root Key %1

Fields #

NameDescription
Number UInt32

Event ID 34: Pku2u is disabled by policy

#
Channel
Operational
Level
Informational
Opcode
Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:00:13.524248+00:00",
    "event_record_id": 3,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-0001-1AB0-838B21B3DC01"
    },
    "execution": {
      "process_id": 968,
      "thread_id": 2336
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 35: Failed to open StoreName certificate store.

#
Channel
Operational
Opcode
Info

Description

Failed to open StoreName certificate store. Error LastError.

Message #

Failed to open %1 certificate store. Error %2

Fields #

NameDescription
StoreName UnicodeString
LastError UInt32

Event ID 36: Failed to validate certificate.

#
Channel
Operational
Opcode
Info

Description

Failed to validate certificate. Hash length doesn't match. Source hash Length Source, calculated hash length Calculated.

Message #

Failed to validate certificate. Hash length doesn't match. Source hash Length %1, calculated hash length %2

Fields #

NameDescription
Source UInt32
Calculated UInt32

Event ID 37: Failed to validate certificate.

#
Channel
Operational
Opcode
Info

Description

Failed to validate certificate. The hash comparison failed.

Message #

Failed to validate certificate. The hash comparison failed

Event ID 38: UPN and client RDN are missing

#
Channel
Operational
Opcode
Info

Event ID 39: The client name doesn't match the UPN.

#
Channel
Operational
Opcode
Info

Description

The client name doesn't match the UPN. UPN is UPN, client name is ClientName.

Message #

The client name doesn't match the UPN. UPN is %1, client name is %2

Fields #

NameDescription
UPN UnicodeString
ClientName UnicodeString

Event ID 40: The client name is psz.

#
Channel
Operational
Opcode
Info

Message #

The client name is %1

Fields #

NameDescription
psz UnicodeString

Event ID 41: The client name matched the UPN.

#
Channel
Operational
Opcode
Info

Description

The client name matched the UPN. UPN is UPN, client name is ClientName.

Message #

The client name matched the UPN. UPN is %1, client name is %2

Fields #

NameDescription
UPN UnicodeString
ClientName UnicodeString

Event ID 42: Certificate validation succeeded as the hash comparison succeeded

#
Channel
Operational
Opcode
Info

Event ID 43: Unable to find the certificate in the HomeGroup Container

#
Channel
Operational
Opcode
Info

Event ID 44: The certificate chains to an untrusted root

#
Channel
Operational
Opcode
Info

Event ID 45: The supplied or saved credman credential with username UserName is not a UPN.

#
Channel
Operational
Level
Error
Opcode
Info

Message #

The supplied or saved credman credential with username %1 is not a UPN.

Fields #

NameDescription
UserName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "{AF9CC194-E9A8-42BD-B0D1-834E9CFAB799}",
    "event_source_name": "",
    "event_id": 45,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-16T21:56:41.6883342+00:00",
    "event_record_id": 4577,
    "correlation": {
      "ActivityID": "{43D097FE-91EE-451F-9819-F3E495F14039}"
    },
    "execution": {
      "process_id": 1108,
      "thread_id": 9372
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "UserName": "domainuser"
  },
  "message": "The supplied or saved credman credential with username domainuser is not a UPN."
}

Event ID 46: Provider Provider is not enabled.

#
Channel
Operational
Level
Error
Opcode
Info

Message #

%1 Provider is not enabled.

Fields #

NameDescription
Provider GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertPolEng",
    "guid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799",
    "event_source_name": "",
    "event_id": 46,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-14T16:28:40.869270+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "0DD0D01B-52DE-45C4-BB8D-BF1723FA1D6F"
    },
    "execution": {
      "process_id": 1092,
      "thread_id": 3352
    },
    "channel": "Microsoft-Windows-CertPoleEng/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Provider": "6D0F37E4-4FAC-4E44-9C07-6B8343FE4953"
  },
  "message": ""
}

Event ID 47: Failed for Certificate (encoding=EncodingType,length=EncodedCertLength,value=EncodedCert).

#
Channel
Operational

Message #

Failed for Certificate (encoding=%1,length=%2,value=%3).

Fields #

NameDescription
EncodingType UInt32
EncodedCertLength UInt32
EncodedCert Binary

Provenance

ETW provider GUID {AF9CC194-E9A8-42BD-B0D1-834E9CFAB799}

Defined in CertPolEng.dll, which carries the event manifest.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB