Microsoft-Windows-CredUI

Event	Title	Channel	Sample	Rule
12001	CredUIPromptForWindowsCredentialsStart	Diagnostic	N	N
12002	CredUIPromptForWindowsCredentialsStop	Diagnostic	N	N
12003	CredUIPromptForCredentialsStart	Diagnostic	N	N
12004	CredUIPromptForCredentialsStop	Diagnostic	N	N

Event ID 12001: CredUIPromptForWindowsCredentialsStart

Channel: Diagnostic
Task: CredUIPromptForWindowsCredentials
Opcode: Start

Event ID 12002: CredUIPromptForWindowsCredentialsStop

Channel: Diagnostic
Task: CredUIPromptForWindowsCredentials
Opcode: Stop

Event ID 12003: CredUIPromptForCredentialsStart

Channel: Diagnostic
Task: CredUIPromptForCredentials
Opcode: Start

Event ID 12004: CredUIPromptForCredentialsStop

Channel: Diagnostic
Task: CredUIPromptForCredentials
Opcode: Stop

Provenance

ETW provider GUID 5a24fcdb-1cf3-477b-b422-ef4909d51223

Defined in wincredui.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4651, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB