Microsoft-Windows-Crypto-NCrypt

26 events across 3 channels

Event	Title	Channel	Sample
1	Cryptographic Operation failed.	Operational	Y
2	Open Provider operation failed.	Operational	Y
3	Open Key operation failed.	Operational	Y
4	Create Key operation failed.	Operational	Y
5	Protect Key operation failed.	Operational	N
6	Unprotect Key operation failed.	Operational	N
7	Protect Secret operation failed.	Operational	N
8	Unprotect Secret operation failed.	Operational	N
9	Key write succeeded.	Operational	Y
10	Key write failed.	Operational	N
11	Delete key succeeded.	Operational	Y
12	Delete key failed.	Operational	Y
13	VBS Key Isolation operation failed.	Operational	N
14	VBS Key Isolation operation failed.	Operational	N
15	New client uses VBS Key Isolation.	Operational	Y
16	Cert-In-Use Message.	CertInUse	N
17	Cert-In-Use Failed.	CertInUse	N
18	Key Guard attestation operation failed.	Operational	N
19	Key Guard attestation operation failed.	Operational	N
20	VBS Key Isolation is not available.	Operational	N
21	Key write succeeded.	KeyMgmt	Y
22	Delete key succeeded.	KeyMgmt	Y
23	Capi1 Container write succeeded.	KeyMgmt	Y
24	Capi1 Container Delete succeeded.	KeyMgmt	Y
25	VBS Key Isolation status: Status.	Operational	N
26	VBS Key Protection restart attempted.	Operational	Y

Event ID 1: Cryptographic Operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Error
Task: OperationFailure

Description

Cryptographic Operation failed.

Message #

Cryptographic Operation failed.

 Cryptographic Parameters:
 	OperationType: %1
 	Provider Name: %2
 	Key Name: %3
 	Key Type: %4
 	Algorithm Name: %5
 
Failure Information:
 	Return Code: %6

Fields #

Name	Description
`OperationType` UInt32	[Cryptographic Parameters] OperationType. Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ProviderName` UnicodeString
`KeyName` UnicodeString
`KeyType` UnicodeString	Known values `%%2499` Machine key `%%2500` User key
`AlgorithmName` UnicodeString
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2025-12-31T19:35:46.563871+00:00",
    "event_record_id": 23,
    "correlation": {
      "ActivityID": "8D2E1BCA-7A8C-0001-8674-2E8D8C7ADC01"
    },
    "execution": {
      "process_id": 5364,
      "thread_id": 6168
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "OperationType": 17,
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "NULL",
    "KeyType": "",
    "AlgorithmName": "",
    "Status": "0x80090029",
    "ProcessName": "powershell.exe"
  },
  "message": ""
}

Event ID 2: Open Provider operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Error
Task: OpenProviderFailure

Description

Open Provider operation failed.

Message #

Open Provider operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 Failure Information:
 	Return Code: %3

Fields #

Name	Description
`ProviderName` UnicodeString	[Cryptographic Parameters] Provider Name.
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString	[Failure Information] Return Code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "{E8ED09DC-100C-45E2-9FC8-B53399EC1F70}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T23:38:46.2948620+00:00",
    "event_record_id": 30,
    "correlation": {},
    "execution": {
      "process_id": 812,
      "thread_id": 524
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Platform Crypto Provider",
    "Status": "0x80090030",
    "ProcessName": "lsass.exe"
  },
  "message": "Open Provider operation failed.\r\n\r\n Cryptographic Parameters:\r\n \tProvider Name:\tMicrosoft Platform Crypto Provider\r\n Failure Information:\r\n \tReturn Code:\tlsass.exe"
}

Event ID 3: Open Key operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Error
Task: OpenKeyFailure

Description

Open Key operation failed.

Message #

Open Key operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 	Key Name: %2
 Failure Information:
 	Return Code: %3

Fields #

Name	Description
`ProviderName` UnicodeString	[Cryptographic Parameters] Provider Name.
`KeyName` UnicodeString	[Cryptographic Parameters] Key Name.
`Status` HexInt32	[Failure Information] Return Code. NTSTATUS reference
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "{E8ED09DC-100C-45E2-9FC8-B53399EC1F70}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-28T11:12:54.3298818+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 356,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "Microsoft Connected Devices Platform device certificate",
    "Status": "0x80090016",
    "ProcessName": "svchost.exe"
  },
  "message": "Open Key operation failed.\r\n\r\n Cryptographic Parameters:\r\n \tProvider Name:\tMicrosoft Software Key Storage Provider\r\n \tKey Name:\tMicrosoft Connected Devices Platform device certificate\r\n Failure Information:\r\n \tReturn Code:\t0x80090016"
}

Event ID 4: Create Key operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Error
Task: KeyCreationFailure

Description

Create Key operation failed.

Message #

Create Key operation failed.

 Cryptographic Parameters:
 	Provider Name: %1
 	Key Name: %2
 	Algorithm Name: %3
 	Flags: %4
 Failure Information:
  	Return Code: %5

Fields #

Name	Description
`ProviderName` UnicodeString	[Cryptographic Parameters] Provider Name.
`KeyName` UnicodeString	[Cryptographic Parameters] Key Name.
`AlgorithmName` UnicodeString	[Cryptographic Parameters] Algorithm Name.
`Flags` HexInt32	[Cryptographic Parameters] Flags.
`Status` HexInt32	[Failure Information] Return Code. NTSTATUS reference
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 2,
    "task": 4,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T01:47:51.933305+00:00",
    "event_record_id": 47,
    "correlation": {},
    "execution": {
      "process_id": 13296,
      "thread_id": 8852
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "ChromeMetricsTestKey",
    "AlgorithmName": "ECDSA_P256",
    "Flags": "0x20000",
    "Status": "0x80090029",
    "ProcessName": "chrome.exe"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 5: Protect Key operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: OperationFailure_5

Description

Protect Key operation failed.

Message #

Protect Key operation failed.

 Cryptographic Parameters:
 	Protector Name: %1
 	Protector Attributes:
			%2
 	Flags: %3
 Failure Information:
 	Return Code: %4

Fields #

Name	Description
`ProtectorName` UnicodeString
`ProtectorAttributes` UnicodeString
`Flags` HexInt32	[Protector Attributes] Flags.
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString

Event ID 6: Unprotect Key operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: OperationFailure_6

Description

Unprotect Key operation failed.

Message #

Unprotect Key operation failed.

 Cryptographic Parameters:
 	Protector Name: %1
 	Recipient Type: %2
 	Flags: %3
 Failure Information:
 	Return Code: %4

Fields #

Name	Description
`ProtectorName` UnicodeString
`RecipientType` UInt32
`Flags` HexInt32	[Cryptographic Parameters] Flags.
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString
`KeyIdLength` UInt32
`KeyId` Binary

Event ID 7: Protect Secret operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: OperationFailure_7

Description

Protect Secret operation failed.

Message #

Protect Secret operation failed.

 Cryptographic Parameters:
 	Flags: %1
 Failure Information:
 	Return Code: %2

Fields #

Name	Description
`Flags` HexInt32	[Cryptographic Parameters] Flags.
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString

Event ID 8: Unprotect Secret operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: OperationFailure_8

Description

Unprotect Secret operation failed.

Message #

Unprotect Secret operation failed.

 Cryptographic Parameters:
 	Flags: %1
 Failure Information:
 	Return Code: %2

Fields #

Name	Description
`Flags` HexInt32	[Cryptographic Parameters] Flags.
`Status` HexInt32	NTSTATUS reference
`ProcessName` UnicodeString

Event ID 9: Key write succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Verbose
Task: Keywritesucceeded

Description

Key write succeeded.

Message #

Key write succeeded.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`KeyModificationType` HexInt32	ModificationType.
`Flags` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32	ServerThreadId.
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	Return Code. NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "{E8ED09DC-100C-45E2-9FC8-B53399EC1F70}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 5,
    "task": 9,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-06-13T05:13:11.7061815+00:00",
    "event_record_id": 35,
    "correlation": {},
    "execution": {
      "process_id": 852,
      "thread_id": 848
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyModificationType": "0x1",
    "Flags": "0x0",
    "KeyName": "iisCngWasKey",
    "KeyFileName": "597367cc37b886d7ee6c493e3befb421_8a99384c-f40f-46dc-9dc2-13adf38045d6",
    "ProcessName": "C:\\Windows\\System32\\inetsrv\\iissetup.exe",
    "ProcessId": "0x1df4",
    "ThreadId": "0x350",
    "UserId": "S-1-5-18",
    "ServiceTag": "",
    "Status": "0x0"
  },
  "message": "Key write succeeded.\r\n\r\n Provider Name:\tMicrosoft Software Key Storage Provider\r\n ModificationType: \t\t0x1\r\n Flags:\t\t0x0\r\n Key Name:\tiisCngWasKey\r\n Key File Name:\t597367cc37b886d7ee6c493e3befb421_8a99384c-f40f-46dc-9dc2-13adf38045d6\r\n ProcessName:\tC:\\Windows\\System32\\inetsrv\\iissetup.exe\r\n ProcessId:\t0x1DF4\r\n ServerThreadId:\t0x350\r\n UserId:\tS-1-5-18\r\n ServiceTag:\t\r\n Return Code:\t0x0"
}

Event ID 10: Key write failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: Keywritefailed

Description

Key write failed.

Message #

Key write failed.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`KeyModificationType` HexInt32
`Flags` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 11: Delete key succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Verbose
Task: Deletekeysucceeded

Description

Delete key succeeded.

Message #

Delete key succeeded.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`Flags` HexInt32
`DeletionType` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32	ServerThreadId.
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	Return Code. NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 5,
    "task": 11,
    "opcode": 0,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-05T22:28:56.224021+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 808,
      "thread_id": 856
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "Flags": "0x40",
    "DeletionType": "0x0",
    "KeyName": "Microsoft Connected Devices Platform device certificate",
    "KeyFileName": "de7cf8a7901d2ad13e5c67c29e5d1662_31383106-803d-411b-9763-a28cdc0f0c3f",
    "ProcessName": "C:\\Windows\\System32\\svchost.exe",
    "ProcessId": "0x1528",
    "ThreadId": "0x358",
    "UserId": "S-1-5-19",
    "ServiceTag": "CDPSvc",
    "Status": "0x0"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 12: Delete key failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Error
Task: Deletekeyfailed

Description

Delete key failed.

Message #

Delete key failed.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`Flags` HexInt32
`DeletionType` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "{E8ED09DC-100C-45E2-9FC8-B53399EC1F70}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T04:27:48.7405078+00:00",
    "event_record_id": 500,
    "correlation": {
      "ActivityID": "{B8277B24-BBEE-4F03-8F3C-0302F5FBC0D9}"
    },
    "execution": {
      "process_id": 868,
      "thread_id": 8732
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133"
    }
  },
  "event_data": {
    "ProviderName": "Microsoft Software Key Storage Provider",
    "Flags": "0x0",
    "DeletionType": "0x0",
    "KeyName": "Microsoft SQL Server$SQLEXPRESS$FallBackCertCng",
    "KeyFileName": "0d1bcf560fac62a46acc682f4472a9ed_8a99384c-f40f-46dc-9dc2-13adf38045d6",
    "ProcessName": "C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe",
    "ProcessId": "0x2efc",
    "ThreadId": "0x221c",
    "UserId": "S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133",
    "ServiceTag": "MSSQL$SQLEXPRESS",
    "Status": "0x80090016"
  },
  "message": "Delete key failed.\r\n\r\n Provider Name:\tMicrosoft Software Key Storage Provider\r\n Flags:\t\t0x0\r\n DeletionType: \t\t0x0\r\n Key Name:\tMicrosoft SQL Server$SQLEXPRESS$FallBackCertCng\r\n Key File Name:\t0d1bcf560fac62a46acc682f4472a9ed_8a99384c-f40f-46dc-9dc2-13adf38045d6\r\n ProcessName:\tC:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe\r\n ProcessId:\t0x2EFC\r\n ServerThreadId:\t0x221C\r\n UserId:\tS-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\r\n ServiceTag:\tMSSQL$SQLEXPRESS\r\n Return Code:\t0x80090016"
}

Event ID 13: VBS Key Isolation operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

VBS Key Isolation operation failed.

Message #

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields #

Name	Description
`Function` AnsiString
`Info` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`StatusString` HexInt32

Event ID 14: VBS Key Isolation operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

VBS Key Isolation operation failed.

Message #

VBS Key Isolation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Client: %5
Client %1 failures: %6
Global %1 failures: %7
Global %1 successes: %8

Fields #

Name	Description
`Function` AnsiString
`Info` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`StatusString` HexInt32
`Client` UnicodeString
`FailuresCount` Int64
`FailuresCountGlobal` Int64
`SuccessCountGlobal` Int64

Event ID 15: New client uses VBS Key Isolation.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Informational
Task: VBSKeyIsolationoperation

Description

New client uses VBS Key Isolation.

Message #

New client uses VBS Key Isolation
Name: %1
Binding status: %2 (%3)
Client instance binding attempts: %4

Fields #

Name	Description
`Client` UnicodeString	Name.
`BindingStatusCode` HexInt32	Binding status.
`BindingStatusString` Int32
`InstanceBindingAttempts` Int64	Client instance binding attempts.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "guid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 0,
    "keywords": 9223372036854775816,
    "time_created": "2023-11-06T01:47:51.932692+00:00",
    "event_record_id": 46,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0001-0C49-DBE43710DA01"
    },
    "execution": {
      "process_id": 808,
      "thread_id": 15768
    },
    "channel": "Microsoft-Windows-Crypto-NCrypt/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Client": "chrome.exe",
    "BindingStatusCode": "0x80090029",
    "BindingStatusString": -2146893783,
    "InstanceBindingAttempts": 1,
    "ImageBindingAttempts": 2,
    "ActiveInstances": 1,
    "ActiveInstancesMax": 1,
    "InstancesLifetime": 2
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 16: Cert-In-Use Message.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: CertInUse
Task: Cert_In_Use

Description

Cert-In-Use.

Message #

Cert-In-Use 

 Message:
 %1

Fields #

Name	Description
`Message` UnicodeString

Event ID 17: Cert-In-Use Failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: CertInUse
Task: Cert_In_UseError

Description

Cert-In-Use Failed.

Message #

Cert-In-Use Failed. 

 ErrorMessage:
 %1

Fields #

Name	Description
`Message` UnicodeString

Event ID 18: Key Guard attestation operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

Key Guard attestation operation failed.

Message #

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)
Global %1 failures: %5
Global %1 successes: %6

Fields #

Name	Description
`Function` AnsiString
`Info` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`StatusString` HexInt32
`FailuresCountGlobal` Int64
`SuccessCountGlobal` Int64

Event ID 19: Key Guard attestation operation failed.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

Key Guard attestation operation failed.

Message #

Key Guard attestation operation failed
Function: %1
Info: %2
Status: %3 (%4)

Fields #

Name	Description
`Function` AnsiString
`Info` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`StatusString` HexInt32

Event ID 20: VBS Key Isolation is not available.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

VBS Key Isolation is not available.

Message #

VBS Key Isolation is not available
Error: %1
Failed to signal: %2
Signaled: %3

Fields #

Name	Description
`ErrorCode` HexInt32
`SignaledFailure` Int64
`SignaledSuccess` Int64

Event ID 21: Key write succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: KeyMgmt
Level: Informational
Task: KeyManagementWriteKeyTask

Description

Key write succeeded.

Message #

Key write succeeded.

 Provider Name: %1
 ModificationType: %2
 Flags: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`KeyModificationType` HexInt32
`Flags` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "event_id": 21,
    "level": 4,
    "task": 16,
    "opcode": 0,
    "time_created": "2026-05-27T20:02:13.2246525+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Crypto-NCrypt"
  },
  "event_data": {
    "ProcessId": "0x2578",
    "KeyModificationType": "0x1",
    "ServiceTag": "",
    "Flags": "0x1",
    "ProcessName": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\148.0.3967.83\\msedgewebview2.exe",
    "Status": "0x0",
    "KeyFileName": "1e313dfb17707690d41bc1ce552b952a_e124ce79-d815-429f-bde2-b7c05bc3199e",
    "UserId": "S-1-5-21-3798294047-1846905762-1150995898-1000",
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "ChromeMetricsTestKey",
    "ThreadId": "0x918"
  }
}

Event ID 22: Delete key succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: KeyMgmt
Level: Informational
Task: KeyManagementDeleteKeyTask

Description

Delete key succeeded.

Message #

Delete key succeeded.

 Provider Name: %1
 Flags: %2
 DeletionType: %3
 Key Name: %4
 Key File Name: %5
 ProcessName: %6
 ProcessId: %7
 ServerThreadId: %8
 UserId: %9
 ServiceTag: %10
 Return Code: %11

Fields #

Name	Description
`ProviderName` UnicodeString
`Flags` HexInt32
`DeletionType` HexInt32
`KeyName` UnicodeString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString
`ProcessId` HexInt32
`ThreadId` HexInt32
`UserId` UnicodeString
`ServiceTag` UnicodeString
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "event_id": 22,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "time_created": "2026-05-27T20:02:13.2556595+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Crypto-NCrypt"
  },
  "event_data": {
    "ProcessId": "0x2578",
    "DeletionType": "0x0",
    "Status": "0x0",
    "Flags": "0x40",
    "ProcessName": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\148.0.3967.83\\msedgewebview2.exe",
    "ServiceTag": "",
    "KeyFileName": "1e313dfb17707690d41bc1ce552b952a_e124ce79-d815-429f-bde2-b7c05bc3199e",
    "UserId": "S-1-5-21-3798294047-1846905762-1150995898-1000",
    "ProviderName": "Microsoft Software Key Storage Provider",
    "KeyName": "ChromeMetricsTestKey",
    "ThreadId": "0x918"
  }
}

Event ID 23: Capi1 Container write succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: KeyMgmt
Level: Informational
Task: KeyManagementWriteKeyTask

Description

Capi1 Container write succeeded.

Message #

Capi1 Container write succeeded.

 Key Name: %1
 Key File Name: %2
 ProcessName: %3

Fields #

Name	Description
`KeyName` AnsiString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "event_id": 23,
    "level": 4,
    "task": 16,
    "opcode": 0,
    "time_created": "2026-04-18T03:03:29.3327868+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Crypto-NCrypt"
  },
  "event_data": {
    "KeyFileName": "f686aace6942fb7f7ceb231212eef4a4_e124ce79-d815-429f-bde2-b7c05bc3199e",
    "ProcessName": "svchost.exe",
    "KeyName": "TSSecKeySet1"
  }
}

Event ID 24: Capi1 Container Delete succeeded.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: KeyMgmt
Level: Informational
Task: KeyManagementDeleteKeyTask

Description

Capi1 Container Delete succeeded.

Message #

Capi1 Container Delete succeeded.

 Key Name: %1
 Key File Name: %2
 ProcessName: %3

Fields #

Name	Description
`KeyName` AnsiString
`KeyFileName` UnicodeString
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "event_id": 24,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "time_created": "2026-04-18T03:03:29.3302190+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Crypto-NCrypt"
  },
  "event_data": {
    "KeyFileName": "f686aace6942fb7f7ceb231212eef4a4_e124ce79-d815-429f-bde2-b7c05bc3199e",
    "ProcessName": "svchost.exe",
    "KeyName": "TSSecKeySet1"
  }
}

Event ID 25: VBS Key Isolation status: Status.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Task: VBSKeyIsolationoperation

Description

VBS Key Isolation status: Status.

Message #

VBS Key Isolation status: %1

Fields #

Name	Description
`Status` UnicodeString	NTSTATUS reference

Event ID 26: VBS Key Protection restart attempted.

Provider: Microsoft-Windows-Crypto-NCrypt
Channel: Operational
Level: Informational
Task: VBSKeyIsolationoperation

Description

VBS Key Protection restart attempted.

Message #

VBS Key Protection restart attempted
LsaIsoLaunchAttempted: %1
Status: %2
TotalAttemptedRestarts: %3
TotalSuccessfulRestarts: %4
CanBeEnabled: %5

Fields #

Name	Description
`LsaIsoLaunchAttempted` Int64
`Status` HexInt32	NTSTATUS reference
`TotalAttemptedRestarts` Int64
`TotalSuccessfulRestarts` Int64
`CanBeEnabled` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Crypto-NCrypt",
    "event_id": 26,
    "level": 4,
    "task": 13,
    "opcode": 0,
    "time_created": "2026-05-27T16:17:08.8482340+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Crypto-NCrypt"
  },
  "event_data": {
    "LsaIsoLaunchAttempted": "0",
    "Status": "0xc0000001",
    "TotalAttemptedRestarts": "5",
    "TotalSuccessfulRestarts": "0",
    "CanBeEnabled": "0"
  }
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e8ed09dc-100c-45e2-9fc8-b53399ec1f70

Defined in ncrypt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3207, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1591, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)