Microsoft-Windows-EapHost
172 events across 4 channels
Event ID 1001: Method not registered or method's registry data could not be accessed.
#Description
Method not registered or method's registry data could not be accessed. LoadConfig: FriendlyName, ConfigCLSID both are empty.
Message #
Event ID 1002: Unable to parse malformed EAP packet
#Description
Unable to parse malformed EAP packet.
Message #
Event ID 1003: Method not registered or registry value error: Function Name=LoadConfig, ArgumentName=MethodString.
#Event ID 1004: Negotiation failed.
#Description
Negotiation failed. No available EAP methods.
Message #
Event ID 1005: Negotiation failed.
#Description
Negotiation failed. Proposed methods list from peer is invalid.
Message #
Event ID 1006: Negotiation failed.
#Description
Negotiation failed. Requested EAP methods not available.
Message #
Event ID 1007: Exceeded the maximum number(32) of Third Party EapHost processes.
#Description
Exceeded the maximum number(32) of Third Party EapHost processes. Discarding the current eap session.
Message #
Event ID 1021: Method not registered or method's registry data could not be accessed.
#Event ID 1022: Method not registered or method's registry data could not be accessed.
#Description
Method not registered or method's registry data could not be accessed. Query registry (RegKeyValue) failed for method: TypeId=TypeId, AuthorId=AuthorId, VendorId=VendorId, VendorType=VendorType.
Message #
Fields #
| Name | Description |
|---|---|
RegKeyValue UnicodeString | |
TypeId UInt8 | |
AuthorId UInt32 | |
VendorId UInt32 | |
VendorType UInt32 |
Event ID 1023: Method not registered or method's registry data could not be accessed.
#Description
Method not registered or method's registry data could not be accessed. Validation failed for key (RegKeyValue), Method Info: Type Id=TypeId, AuthorId=AuthorId, vendorId=VendorId, vendorType=VendorType.
Message #
Fields #
| Name | Description |
|---|---|
RegKeyValue UnicodeString | |
TypeId UInt8 | |
AuthorId UInt32 | |
VendorId UInt32 | |
VendorType UInt32 |
Event ID 1041: Unable to Initialize COM library.
#Description
Unable to Initialize COM library. An instance of EapHostAuthenticatorInvokeConfigUI() is already running. CoInitializeEx returned S_FALSE.
Message #
Event ID 1042: Unable to Initialize COM library.
#Description
Unable to Initialize COM library. The wrong concurrency model was specified for EapHostAuthenticatorInvokeConfigUI(). COM Error: RPC_E_CHANGED_MODE.
Message #
Event ID 1043: Unable to Initialize COM library for EapHostAuthenticatorInitialize().
#Event ID 1044: Invalid eatInnerEapMethodType returned by the EAP method.
#Event ID 1045: Method does not support EapMethodAuthenticatorUpdateInnerMethodParams() API, but UpdateInnerMethodParams() called
#Description
Method does not support EapMethodAuthenticatorUpdateInnerMethodParams() API, but UpdateInnerMethodParams() called.
Message #
Event ID 1046: Client's response: NAK=NAK, Accept=Accept.
#Event ID 1047: No preferred methods list provided by Peer
#Description
No preferred methods list provided by Peer.
Message #
Event ID 1048: Session(SessionId), state(state), receive packet id(Packet ID), length(Packet Length).
#Event ID 1049: send packet id(PacketId), length(Packet Length).
#Event ID 1051: NAP exchange required, get SoH response from network policy server
#Description
NAP exchange required, get SoH response from network policy server.
Message #
Event ID 1052: Method does not support stand-alone mode.
#Event ID 1053: Unable to parse malformed EAP packet.
#Description
Unable to parse malformed EAP packet. ERROR_PPP_INVALID_PACKET returned.
Message #
Event ID 1054: NAK Response: Method (VenId(VendorId), VenType(VendorType), Type(TypeId)) present.
#Event ID 2001: Eap method friendly name can not be verified or Key Name path could not be accessed; Error: type(TypeId), authId(AuthorId), vendorId(VendorId), vendorType(VendorType).
#Event ID 2002: Skipping: Skipping validation failed.
#Event ID 2003: CoTaskMemAlloc() failed for SoH.
#Description
CoTaskMemAlloc() failed for SoH. SoH not saved.
Message #
Event ID 2004: Could not initialize COM library in service control manager notification thread
#Description
Could not initialize COM library in service control manager notification thread.
Message #
Event ID 2005: SoH change failed.
#Event ID 2006: ConfigSchema validation failed.
#Event ID 2007: EapQec Listening thread handle is NULL
#Description
EapQec Listening thread handle is NULL.
Message #
Event ID 2008: Session(Connection Name, Session ID) in use.
#Event ID 2009: EAP method does not support Function Name.
#Event ID 2010: XML configuration problem; Failed to find root element.
#Description
XML configuration problem; Failed to find root element.
Message #
Event ID 2011: XML configuration problem; Invalid parameter passed.
#Description
XML configuration problem; Invalid parameter passed.
Message #
Event ID 2012: Registry key validation successful.
#Description
Registry key validation successful.
Message #
Event ID 2013: Client not NAP enabled.
#Description
Client not NAP enabled. SoH change failed.
Message #
Event ID 2014: No SoH response received for Connection Name.
#Event ID 2016: Notify SoH change failed with interface: ConnectionName.
#Event ID 2017: Session(Session ID): Received EAP-Failure after Identity exchange: There is likely a problem with the authenticating user's account.
#Event ID 2018: Session: Received EAP-Failure after EAP-Nak negotiation: The client & server are not configured to support the same EAP methods.
#Description
Session(SessionID): Received EAP-Failure after EAP-Nak negotiation: The client & server are not configured to support the same EAP methods. (Server offered EAP type ServerOfferedMethod; Client sent a Nak, and requested EAP type ClientRequestedMethod.)
Message #
Fields #
| Name | Description |
|---|---|
SessionID Int32 | |
ServerOfferedMethod Int32 | |
ClientRequestedMethod AnsiString |
Event ID 2019: Method does not implement Function Name.
#Event ID 2020: COM API Error_Description Failed.
#Event ID 2021: Eap Host event log could not be opened.
#Event ID 2022: _beginthreadex failed.
#Event ID 2023: Invalid XML document.
#Event ID 2024: Unable to open Error_Description handle.
#Event ID 2025: Exceeded the maximum number(32) of Third Party EapHost processes.
#Description
Exceeded the maximum number(32) of Third Party EapHost processes. Running the current eap session in short lived Eap3Host process.
Message #
Event ID 2086: EapHostPeerGetResult returned a failure.
#Event ID 2089: EAP session is completing during the authentication phase.
#Event ID 3001: EAPHost failed to load.
#Event ID 3002: Could not find the requested EapMethod: TypeId(TypeId), AuthorId(AuthorId), VendorId(VendorId), VendorType(VendorType).
#Event ID 3021: EAP methods not registered or registry data could not be accessed; Failed to open registry Registry Key, Error Code: ErrorCode.
#Event ID 3022: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\TypeId.
#Event ID 3023: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId.
#Event ID 3024: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId\\VendorType.
#Event ID 3025: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId.
#Event ID 3026: Skipping: Unable to add EAP method.
#Event ID 3027: XML configuration problem; Failed to get EapMethodType node.
#Event ID 3028: XML configuration problem; Data Type mismatch for debugString.
#Event ID 3029: XML configuration problem; Bad method: TypeId(TypeId), AuthorId(AuthorId), VendorId(VendorId), VendorType(VendorType).
#Event ID 3042: Unable to add new method after re-initialization
#Description
Unable to add new method after re-initialization.
Message #
Event ID 3043: EAP Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), vendorType(VendorType), error(ErrorString).
#Event ID 3044: Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), vendorType(VendorType), error(ErrorString).
#Event ID 3045: Error ErrorCode, reading EAP method friendly name(muiRead).
#Event ID 3046: EAP method not found, re-initializing the library manager's EapMethodList data
#Description
EAP method not found, re-initializing the library manager's EapMethodList data.
Message #
Event ID 3047: New method found after re-initializing EapMethodList data
#Description
New method found after re-initializing EapMethodList data.
Message #
Event ID 3048: New EAP method added to EapMethodList: TypeId=TypeId, AuthorId=AuthorId, VendorId=VendorId, VendorType=VendorType.
#Event ID 4001: debugString.
#Event ID 4002: debugString.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 6eb8db94-fe96-443f-a366-5fe0cee7fb1c
Defined in eapsvc.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4946, captured 2026-06-02