detection.wiki

Microsoft-Windows-CoreSystem-NetProvision-JoinProviderOnline

EventTitleChannelSampleRule
4098The machine ComputerName successfully completed an offline domain join to the …SystemNN
4099The machine ComputerName attempted to join the domain DomainName while offline …SystemNN

Event ID 4098: The machine ComputerName successfully completed an offline domain join to the domain DomainName.

#
Channel
System

Message #

The machine %2 successfully completed an offline domain join to the domain %1.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString

Event ID 4099: The machine ComputerName attempted to join the domain DomainName while offline but failed.

#
Channel
System

Description

The machine ComputerName attempted to join the domain DomainName while offline but failed. The computer name was set to ComputerName. A common cause of failure is the SKU does not support domain join, see the error code for more information. The error code was NetStatusCode.

Message #

The machine %2 attempted to join the domain %1 while offline but failed. The computer name was set to %2. A common cause of failure is the SKU does not support domain join, see the error code for more information. The error code was %3.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString
NetStatusCode UInt32

Provenance

ETW provider GUID 3629dd4d-d6f1-4302-a623-0768b51501c7

Defined in joinproviderol.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB