Microsoft-Windows-EapHost

Event	Title	Channel	Sample	Rule
1001	Method not registered or method's registry data could not be accessed.	Application	N	N
1002	Unable to parse malformed EAP packet	Application	N	N
1003	Method not registered or registry value error: Function Name=LoadConfig, …	Application	N	N
1004	Negotiation failed.	Application	N	N
1005	Negotiation failed.	Application	N	N
1006	Negotiation failed.	Application	N	N
1007	Exceeded the maximum number(32) of Third Party EapHost processes.	Application	N	N
1021	Method not registered or method's registry data could not be accessed.	Operational	N	N
1022	Method not registered or method's registry data could not be accessed.	Operational	N	N
1023	Method not registered or method's registry data could not be accessed.	Operational	N	N
1041	Unable to Initialize COM library.	Analytic	N	N
1042	Unable to Initialize COM library.	Analytic	N	N
1043	Unable to Initialize COM library for EapHostAuthenticatorInitialize().	Analytic	N	N
1044	Invalid eatInnerEapMethodType returned by the EAP method.	Analytic	N	N
1045	Method does not support EapMethodAuthenticatorUpdateInnerMethodParams() API, but …	Analytic	N	N
1046	Client's response: NAK=NAK, Accept=Accept.	Analytic	N	N
1047	No preferred methods list provided by Peer	Analytic	N	N
1048	Session(SessionId), state(state), receive packet id(Packet ID), length(Packet …	Analytic	N	N
1049	send packet id(PacketId), length(Packet Length).	Analytic	N	N
1050	SoH response found	Analytic	N	N
1051	NAP exchange required, get SoH response from network policy server	Analytic	N	N
1052	Method does not support stand-alone mode.	Analytic	N	N
1053	Unable to parse malformed EAP packet.	Analytic	N	N
1054	NAK Response: Method (VenId(VendorId), VenType(VendorType), Type(TypeId)) …	Analytic	N	N
1055	Performance	Debug	N	N
1056	Performance	Debug	N	N
1057	Performance	Debug	N	N
1058	Performance	Debug	N	N
1059	Performance	Debug	N	N
1060	Performance	Debug	N	N
1061	Performance	Debug	N	N
1062	Performance	Debug	N	N
1063	Performance	Debug	N	N
1064	Performance	Debug	N	N
1065	Performance	Debug	N	N
1066	Performance	Debug	N	N
1067	Performance	Debug	N	N
1068	Performance	Debug	N	N
1069	Performance	Debug	N	N
1070	Performance	Debug	N	N
1071	Performance	Debug	N	N
1072	Performance	Debug	N	N
1073	Performance	Debug	N	N
1074	Performance	Debug	N	N
1075	Performance	Debug	N	N
1076	Performance	Debug	N	N
1077	Performance	Debug	N	N
1078	Performance	Debug	N	N
1079	Performance	Debug	N	N
1080	Performance	Debug	N	N
1081	Performance	Debug	N	N
1082	Performance	Debug	N	N
1083	Performance	Debug	N	N
1084	Performance	Debug	N	N
1085	Performance	Debug	N	N
1086	Performance	Debug	N	N
1087	Performance	Debug	N	N
1088	Performance	Debug	N	N
1089	Performance	Debug	N	N
1090	Performance	Debug	N	N
1091	Performance	Debug	N	N
1092	Performance	Debug	N	N
2001	Eap method friendly name can not be verified or Key Name path could not be …	Application	N	N
2002	Skipping: Skipping validation failed.	Application	N	N
2003	CoTaskMemAlloc() failed for SoH.	Analytic	N	N
2004	Could not initialize COM library in service control manager notification thread	Analytic	N	N
2005	SoH change failed.	Analytic	N	N
2006	ConfigSchema validation failed.	Analytic	N	N
2007	EapQec Listening thread handle is NULL	Analytic	N	N
2008	Session(Connection Name, Session ID) in use.	Analytic	N	N
2009	EAP method does not support Function Name.	Analytic	N	N
2010	XML configuration problem; Failed to find root element.	Operational	N	N
2011	XML configuration problem; Invalid parameter passed.	Operational	N	N
2012	Registry key validation successful.	Analytic	N	N
2013	Client not NAP enabled.	Analytic	N	N
2014	No SoH response received for Connection Name.	Analytic	N	N
2015	Notify SoH change succeeded.	Analytic	N	N
2016	Notify SoH change failed with interface: ConnectionName.	Analytic	N	N
2017	Session(Session ID): Received EAP-Failure after Identity exchange: There is …	Analytic	N	N
2018	Session: Received EAP-Failure after EAP-Nak negotiation: The client & server are …	Analytic	N	N
2019	Method does not implement Function Name.	Analytic	N	N
2020	COM API Error_Description Failed.	Analytic	N	N
2021	Eap Host event log could not be opened.	Analytic	N	N
2022	_beginthreadex failed.	Analytic	N	N
2023	Invalid XML document.	Operational	N	N
2024	Unable to open Error_Description handle.	Operational	N	N
2025	Exceeded the maximum number(32) of Third Party EapHost processes.	Application	N	N
2026	Performance	Debug	N	N
2027	Performance	Debug	N	N
2028	Performance	Debug	N	N
2029	Performance	Debug	N	N
2030	Performance	Debug	N	N
2031	Performance	Debug	N	N
2032	Performance	Debug	N	N
2033	Performance	Debug	N	N
2034	Performance	Debug	N	N
2035	Performance	Debug	N	N
2036	Performance	Debug	N	N
2037	Performance	Debug	N	N
2038	Performance	Debug	N	N
2039	Performance	Debug	N	N
2040	Performance	Debug	N	N
2041	Performance	Debug	N	N
2042	Performance	Debug	N	N
2043	Performance	Debug	N	N
2044	Performance	Debug	N	N
2045	Performance	Debug	N	N
2046	Performance	Debug	N	N
2047	Performance	Debug	N	N
2048	Performance	Debug	N	N
2049	Performance	Debug	N	N
2050	Performance	Debug	N	N
2051	Performance	Debug	N	N
2052	Performance	Debug	N	N
2053	Performance	Debug	N	N
2054	Performance	Debug	N	N
2055	Performance	Debug	N	N
2056	Performance	Debug	N	N
2057	Performance	Debug	N	N
2058	Performance	Debug	N	N
2059	Performance	Debug	N	N
2060	Performance	Debug	N	N
2061	Performance	Debug	N	N
2062	Performance	Debug	N	N
2063	Performance	Debug	N	N
2064	Performance	Debug	N	N
2065	Performance	Debug	N	N
2066	Performance	Debug	N	N
2067	Performance	Debug	N	N
2068	Performance	Debug	N	N
2069	Performance	Debug	N	N
2070	Performance	Debug	N	N
2071	Performance	Debug	N	N
2072	Performance	Debug	N	N
2073	Performance	Debug	N	N
2074	Performance	Debug	N	N
2075	Performance	Debug	N	N
2076	Performance	Debug	N	N
2077	Performance	Debug	N	N
2078	Performance	Debug	N	N
2079	Performance	Debug	N	N
2080	Performance	Debug	N	N
2081	Performance	Debug	N	N
2082	Performance	Debug	N	N
2083	Performance	Debug	N	N
2084	Performance	Debug	N	N
2085	Performance	Debug	N	N
2086	EapHostPeerGetResult returned a failure.	Operational	N	N
2087	User Entered Credentials.	Operational	N	N
2088	User Uses Saved Credentials.	Operational	N	N
2089	EAP session is completing during the authentication phase.	Operational	N	N
3001	EAPHost failed to load.	Application	N	N
3002	Could not find the requested EapMethod: TypeId(TypeId), AuthorId(AuthorId), …	Application	N	N
3021	EAP methods not registered or registry data could not be accessed; Failed to …	Operational	N	N
3022	EAP methods not registered or registry data could not be accessed; Failed to …	Operational	N	N
3023	EAP methods not registered or registry data could not be accessed; Failed to …	Operational	N	N
3024	EAP methods not registered or registry data could not be accessed; Failed to …	Operational	N	N
3025	EAP methods not registered or registry data could not be accessed; Failed to …	Operational	N	N
3026	Skipping: Unable to add EAP method.	Operational	N	N
3027	XML configuration problem; Failed to get EapMethodType node.	Operational	N	N
3028	XML configuration problem; Data Type mismatch for debugString.	Operational	N	N
3029	XML configuration problem; Bad method: TypeId(TypeId), AuthorId(AuthorId), …	Operational	N	N
3041	Could not load method.	Analytic	N	N
3042	Unable to add new method after re-initialization	Analytic	N	N
3043	EAP Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), …	Analytic	N	N
3044	Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), …	Analytic	N	N
3045	Error ErrorCode, reading EAP method friendly name(muiRead).	Analytic	N	N
3046	EAP method not found, re-initializing the library manager's EapMethodList data	Analytic	N	N
3047	New method found after re-initializing EapMethodList data	Analytic	N	N
3048	New EAP method added to EapMethodList: TypeId=TypeId, AuthorId=AuthorId, …	Analytic	N	N
4001	debugString.	Debug	N	N
4002	debugString.	Debug	N	N

Event ID 1001: Method not registered or method's registry data could not be accessed.

Channel: Application
Task: Authenticator

Description

Method not registered or method's registry data could not be accessed. LoadConfig: FriendlyName, ConfigCLSID both are empty.

Message #

Method not registered or method's registry data could not be accessed. LoadConfig: FriendlyName, ConfigCLSID both are empty

Event ID 1002: Unable to parse malformed EAP packet

Channel: Application
Task: Authenticator

Event ID 1003: Method not registered or registry value error: Function Name=LoadConfig, ArgumentName=MethodString.

Channel: Application
Task: Authenticator

Message #

Method not registered or registry value error: Function Name=LoadConfig, ArgumentName=%1

Fields #

Name	Description
`MethodString` UnicodeString

Event ID 1004: Negotiation failed.

Channel: Application
Task: Authenticator

Description

Negotiation failed. No available EAP methods.

Message #

Negotiation failed. No available EAP methods

Event ID 1005: Negotiation failed.

Channel: Application
Task: Authenticator

Description

Negotiation failed. Proposed methods list from peer is invalid.

Message #

Negotiation failed. Proposed methods list from peer is invalid

Event ID 1006: Negotiation failed.

Channel: Application
Task: Authenticator

Description

Negotiation failed. Requested EAP methods not available.

Message #

Negotiation failed. Requested EAP methods not available

Event ID 1007: Exceeded the maximum number(32) of Third Party EapHost processes.

Channel: Application
Task: Authenticator

Description

Exceeded the maximum number(32) of Third Party EapHost processes. Discarding the current eap session.

Message #

Exceeded the maximum number(32) of Third Party EapHost processes. Discarding the current eap session.

Event ID 1021: Method not registered or method's registry data could not be accessed.

Channel: Operational
Task: Authenticator

Description

Method not registered or method's registry data could not be accessed. Unable to open registry key Registry Key, error code ErrorCode.

Message #

Method not registered or method's registry data could not be accessed. Unable to open registry key %1, error code %2

Fields #

Name	Description
`RegistryKey` UnicodeString
`ErrorCode` Int8

Event ID 1022: Method not registered or method's registry data could not be accessed.

Channel: Operational
Task: Authenticator

Description

Method not registered or method's registry data could not be accessed. Query registry (RegKeyValue) failed for method: TypeId=TypeId, AuthorId=AuthorId, VendorId=VendorId, VendorType=VendorType.

Message #

Method not registered or method's registry data could not be accessed. Query registry (%1) failed for method: TypeId=%2, AuthorId=%3, VendorId=%4, VendorType=%5

Fields #

Name	Description
`RegKeyValue` UnicodeString
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 1023: Method not registered or method's registry data could not be accessed.

Channel: Operational
Task: Authenticator

Description

Method not registered or method's registry data could not be accessed. Validation failed for key (RegKeyValue), Method Info: Type Id=TypeId, AuthorId=AuthorId, vendorId=VendorId, vendorType=VendorType.

Message #

Method not registered or method's registry data could not be accessed. Validation failed for key (%1), Method Info: Type Id=%2, AuthorId=%3, vendorId=%4, vendorType=%5

Fields #

Name	Description
`RegKeyValue` UnicodeString
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 1041: Unable to Initialize COM library.

Channel: Analytic
Task: Authenticator

Description

Unable to Initialize COM library. An instance of EapHostAuthenticatorInvokeConfigUI() is already running. CoInitializeEx returned S_FALSE.

Message #

Unable to Initialize COM library. An instance of EapHostAuthenticatorInvokeConfigUI() is already running. CoInitializeEx returned S_FALSE.

Event ID 1042: Unable to Initialize COM library.

Channel: Analytic
Task: Authenticator

Description

Unable to Initialize COM library. The wrong concurrency model was specified for EapHostAuthenticatorInvokeConfigUI(). COM Error: RPC_E_CHANGED_MODE.

Message #

Unable to Initialize COM library. The wrong concurrency model was specified for EapHostAuthenticatorInvokeConfigUI(). COM Error: RPC_E_CHANGED_MODE.

Event ID 1043: Unable to Initialize COM library for EapHostAuthenticatorInitialize().

Channel: Analytic
Task: Authenticator

Message #

Unable to Initialize COM library for EapHostAuthenticatorInitialize(). 
 Error Description: %1

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 1044: Invalid eatInnerEapMethodType returned by the EAP method.

Channel: Analytic
Task: Authenticator

Description

Invalid eatInnerEapMethodType returned by the EAP method. Attribute has incorrect format (Length).

Message #

Invalid eatInnerEapMethodType returned by the EAP method. Attribute has incorrect format (%1)

Fields #

Name	Description
`Length` Int32

Event ID 1045: Method does not support EapMethodAuthenticatorUpdateInnerMethodParams() API, but UpdateInnerMethodParams() called

Channel: Analytic
Task: Authenticator

Event ID 1046: Client's response: NAK=NAK, Accept=Accept.

Channel: Analytic
Task: Authenticator

Message #

Client's response: NAK=%1, Accept=%2

Fields #

Name	Description
`NAK` UInt8
`Accept` UInt8

Event ID 1047: No preferred methods list provided by Peer

Channel: Analytic
Task: Authenticator

Event ID 1048: Session(SessionId), state(state), receive packet id(Packet ID), length(Packet Length).

Channel: Analytic
Task: Authenticator

Message #

Session(%1), state(%2), receive packet id(%3), length(%4)

Fields #

Name	Description
`SessionId` UInt32
`state` Int8
`PacketID` UInt8
`PacketLength` UInt16

Event ID 1049: send packet id(PacketId), length(Packet Length).

Channel: Analytic
Task: Authenticator

Message #

send packet id(%1), length(%2)

Fields #

Name	Description
`PacketId` UInt8
`PacketLength` UInt16

Event ID 1050: SoH response found

Channel: Analytic
Task: Authenticator

Event ID 1051: NAP exchange required, get SoH response from network policy server

Channel: Analytic
Task: Authenticator

Event ID 1052: Method does not support stand-alone mode.

Channel: Analytic

Description

Method does not support stand-alone mode. Skipping EapMethod TypeId=TypeId, AuthorId=AuthorId.

Message #

Method does not support stand-alone mode. Skipping EapMethod TypeId=%1, AuthorId=%2

Fields #

Name	Description
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 1053: Unable to parse malformed EAP packet.

Channel: Analytic
Task: Authenticator

Description

Unable to parse malformed EAP packet. ERROR_PPP_INVALID_PACKET returned.

Message #

Unable to parse malformed EAP packet. ERROR_PPP_INVALID_PACKET returned

Event ID 1054: NAK Response: Method (VenId(VendorId), VenType(VendorType), Type(TypeId)) present.

Channel: Analytic
Task: Authenticator

Message #

NAK Response: Method (VenId(%2), VenType(%3), Type(%1))  present

Fields #

Name	Description
`TypeId` UInt8
`VendorId` UInt32
`VendorType` UInt32

Event ID 1055: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1056: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1057: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1058: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1059: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1060: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1061: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1062: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1063: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1064: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1065: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1066: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1067: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1068: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1069: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1070: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1071: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1072: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1073: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1074: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1075: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1076: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1077: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1078: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1079: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1080: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1081: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1082: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1083: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1084: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1085: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1086: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1087: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1088: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1089: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1090: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1091: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 1092: Performance

Channel: Debug
Task: Authenticator

Fields #

Name	Description
`PerfId` UInt64

Event ID 2001: Eap method friendly name can not be verified or Key Name path could not be accessed; Error: type(TypeId), authId(AuthorId), vendorId(VendorId), vendorType(VendorType).

Channel: Application
Task: Peer

Message #

Eap method friendly name can not be verified or %1 path could not be accessed; Error: type(%2), authId(%3), vendorId(%4), vendorType(%5)

Fields #

Name	Description
`KeyName` AnsiString
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 2002: Skipping: Skipping validation failed.

Channel: Application
Task: Peer

Description

Skipping: Skipping validation failed. Error: typeId=KeyName, authorId=TypeId, vendorId=AuthorId, vendorType=VendorId.

Message #

Skipping: %1 validation failed. Error: typeId=%2, authorId=%3, vendorId=%4, vendorType=%5

Fields #

Name	Description
`KeyName` AnsiString
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 2003: CoTaskMemAlloc() failed for SoH.

Channel: Analytic
Task: Peer

Description

CoTaskMemAlloc() failed for SoH. SoH not saved.

Message #

CoTaskMemAlloc() failed for SoH. SoH not saved.

Event ID 2004: Could not initialize COM library in service control manager notification thread

Channel: Analytic
Task: Peer

Event ID 2005: SoH change failed.

Channel: Analytic
Task: Peer

Description

SoH change failed. EapQec::NotifySoHChange caught exception for Connection: 0xErrorCode.

Message #

SoH change failed. EapQec::NotifySoHChange caught exception for %1: 0x%2

Fields #

Name	Description
`Connection` UnicodeString
`ErrorCode` UInt32

Event ID 2006: ConfigSchema validation failed.

Channel: Analytic
Task: Peer

Description

ConfigSchema validation failed. Error Error.

Message #

ConfigSchema validation failed. Error  %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 2007: EapQec Listening thread handle is NULL

Channel: Analytic
Task: Peer

Event ID 2008: Session(Connection Name, Session ID) in use.

Channel: Analytic
Task: Peer

Message #

Session(%1, %2) in use

Fields #

Name	Description
`ConnectionName` UnicodeString
`SessionID` Int32

Event ID 2009: EAP method does not support Function Name.

Channel: Analytic
Task: Peer

Message #

EAP method does not support %1.

Fields #

Name	Description
`FunctionName` AnsiString

Event ID 2010: XML configuration problem; Failed to find root element.

Channel: Operational
Task: Peer

Message #

XML configuration problem;  Failed to find root element.

Event ID 2011: XML configuration problem; Invalid parameter passed.

Channel: Operational
Task: Peer

Message #

XML configuration problem;  Invalid parameter passed.

Event ID 2012: Registry key validation successful.

Channel: Analytic
Task: Peer

Event ID 2013: Client not NAP enabled.

Channel: Analytic
Task: Peer

Description

Client not NAP enabled. SoH change failed.

Message #

Client not NAP enabled. SoH change failed.

Event ID 2014: No SoH response received for Connection Name.

Channel: Analytic
Task: Peer

Message #

No SoH response received for %1

Fields #

Name	Description
`ConnectionName` UnicodeString

Event ID 2015: Notify SoH change succeeded.

Channel: Analytic
Task: Peer

Event ID 2016: Notify SoH change failed with interface: ConnectionName.

Channel: Analytic
Task: Peer

Message #

Notify SoH change failed with interface: %1.

Fields #

Name	Description
`ConnectionName` UnicodeString

Event ID 2017: Session(Session ID): Received EAP-Failure after Identity exchange: There is likely a problem with the authenticating user's account.

Channel: Analytic
Task: Peer

Message #

Session(%1): Received EAP-Failure after Identity exchange:  There is likely a problem with the authenticating user's account.

Fields #

Name	Description
`SessionID` Int32

Event ID 2018: Session: Received EAP-Failure after EAP-Nak negotiation: The client & server are not configured to support the same EAP methods.

Channel: Analytic
Task: Peer

Description

Session(SessionID): Received EAP-Failure after EAP-Nak negotiation: The client & server are not configured to support the same EAP methods. (Server offered EAP type ServerOfferedMethod; Client sent a Nak, and requested EAP type ClientRequestedMethod.)

Message #

Session(%1): Received EAP-Failure after EAP-Nak negotiation:  The client & server are not configured to support the same EAP methods. (Server offered EAP type %2; Client sent a Nak, and requested EAP type %3.)

Fields #

Name	Description
`SessionID` Int32
`ServerOfferedMethod` Int32
`ClientRequestedMethod` AnsiString

Event ID 2019: Method does not implement Function Name.

Channel: Analytic
Task: Peer

Message #

Method does not implement %1

Fields #

Name	Description
`FunctionName` AnsiString

Event ID 2020: COM API Error_Description Failed.

Channel: Analytic
Task: Peer

Message #

COM API %1 Failed.
 Error Description : %2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorDescription` UnicodeString

Event ID 2021: Eap Host event log could not be opened.

Channel: Analytic

Description

Eap Host event log could not be opened. RegisterEventSource failed. Error Description : {Error}.

Message #

Eap Host event log could not be opened. RegisterEventSource failed. Error Description : {Error}

Fields #

Name	Description
`Error`

Event ID 2022: _beginthreadex failed.

Channel: Analytic
Task: Peer

Message #

_beginthreadex failed.
 Error Description : %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 2023: Invalid XML document.

Channel: Operational
Task: Peer

Description

Invalid XML document. Failed to selectSingleNode.

Message #

Invalid XML document. Failed to selectSingleNode.
 Error Description : %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 2024: Unable to open Error_Description handle.

Channel: Operational
Task: Peer

Message #

Unable to open %1 handle.
 Error Description : %2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorDescription` UnicodeString

Event ID 2025: Exceeded the maximum number(32) of Third Party EapHost processes.

Channel: Application
Task: Peer

Description

Exceeded the maximum number(32) of Third Party EapHost processes. Running the current eap session in short lived Eap3Host process.

Message #

Exceeded the maximum number(32) of Third Party EapHost processes. Running the current eap session in short lived Eap3Host process.

Event ID 2026: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2027: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2028: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2029: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2030: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2031: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2032: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2033: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2034: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2035: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2036: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2037: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2038: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2039: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2040: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2041: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2042: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2043: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2044: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2045: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2046: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2047: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2048: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2049: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2050: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2051: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2052: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2053: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2054: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2055: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2056: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2057: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2058: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2059: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2060: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2061: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2062: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2063: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2064: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2065: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2066: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2067: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2068: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2069: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2070: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2071: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2072: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2073: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2074: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2075: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2076: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2077: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2078: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2079: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2080: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2081: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2082: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2083: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2084: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2085: Performance

Channel: Debug
Task: Peer

Fields #

Name	Description
`PerfId` UInt64

Event ID 2086: EapHostPeerGetResult returned a failure.

Channel: Operational
Task: Peer

Message #

EapHostPeerGetResult returned a failure.
Eap Method Friendly Name: %2
Reason code: %1
Root Cause String: %3
Repair String: %4

Fields #

Name	Description
`ReasonCode` UInt32
`EAPMethodFriendlyName` UnicodeString
`EAPErrorRootCause` UnicodeString
`EAPErrorRepair` UnicodeString

Event ID 2087: User Entered Credentials.

Channel: Operational
Task: Peer

References #

Microsoft Learn

Event ID 2088: User Uses Saved Credentials.

Channel: Operational
Task: Peer

Event ID 2089: EAP session is completing during the authentication phase.

Channel: Operational
Task: Peer

References #

Microsoft Learn

Event ID 3001: EAPHost failed to load.

Channel: Application
Task: Common

Description

EAPHost failed to load. LoadLibraryW(ModuleName) failed Error.

Message #

EAPHost failed to load. LoadLibraryW(%1) failed %2

Fields #

Name	Description
`ModuleName` UnicodeString
`Error` UInt32

Event ID 3002: Could not find the requested EapMethod: TypeId(TypeId), AuthorId(AuthorId), VendorId(VendorId), VendorType(VendorType).

Channel: Application
Task: Common

Message #

Could not find the requested EapMethod: TypeId(%1), AuthorId(%2), VendorId(%3), VendorType(%4)

Fields #

Name	Description
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 3021: EAP methods not registered or registry data could not be accessed; Failed to open registry Registry Key, Error Code: ErrorCode.

Channel: Operational
Task: Common

Message #

EAP methods not registered or registry data could not be accessed; Failed to open registry %1, Error Code: %2

Fields #

Name	Description
`RegistryKey` UnicodeString
`ErrorCode` Int8

Event ID 3022: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\TypeId.

Channel: Operational
Task: Common

Description

EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\TypeId. Skip this type ID.

Message #

EAP methods not registered or registry data could not be accessed; Failed to open method registry %2\\%1. Skip this type ID

Fields #

Name	Description
`TypeId` UnicodeString
`AuthorId` UnicodeString

Event ID 3023: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId.

Channel: Operational
Task: Common

Description

EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId. Skip this author ID.

Message #

EAP methods not registered or registry data could not be accessed; Failed to open method registry %1. Skip this author ID

Fields #

Name	Description
`AuthorId` UnicodeString

Event ID 3024: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId\\VendorType.

Channel: Operational
Task: Common

Description

EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId\\VendorType. Skip this vendor type.

Message #

EAP methods not registered or registry data could not be accessed; Failed to open method registry %1\\254\\%2\\%3. Skip this vendor type

Fields #

Name	Description
`AuthorId` UInt32
`VendorId` UnicodeString
`VendorType` UnicodeString

Event ID 3025: EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId.

Channel: Operational
Task: Common

Description

EAP methods not registered or registry data could not be accessed; Failed to open method registry AuthorId\\254\\VendorId. Skip this vendor ID.

Message #

EAP methods not registered or registry data could not be accessed; Failed to open method registry %1\\254\\%2. Skip this vendor ID

Fields #

Name	Description
`AuthorId` UInt32
`VendorId` UnicodeString

Event ID 3026: Skipping: Unable to add EAP method.

Channel: Operational
Task: Common

Description

Skipping: Unable to add EAP method. Friendly name not present. TypeId(TypeId), AuthorId(AuthorId), VendorId(VendorId), VendorType(VendorType).

Message #

Skipping: Unable to add EAP method. Friendly name not present. TypeId(%1), AuthorId(%2), VendorId(%3), VendorType(%4)

Fields #

Name	Description
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 3027: XML configuration problem; Failed to get EapMethodType node.

Channel: Operational
Task: Common

Message #

XML configuration problem; Failed to get EapMethodType node 
. Error Description: %1

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 3028: XML configuration problem; Data Type mismatch for debugString.

Channel: Operational
Task: Common

Message #

XML configuration problem; Data Type mismatch for %1

Fields #

Name	Description
`debugString` AnsiString

Event ID 3029: XML configuration problem; Bad method: TypeId(TypeId), AuthorId(AuthorId), VendorId(VendorId), VendorType(VendorType).

Channel: Operational
Task: Common

Message #

XML configuration problem; Bad method: TypeId(%1), AuthorId(%2), VendorId(%3), VendorType(%4)

Fields #

Name	Description
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 3041: Could not load method.

Channel: Analytic
Task: Common

Description

Could not load method. Out of memory.

Message #

Could not load method. Out of memory

Event ID 3042: Unable to add new method after re-initialization

Channel: Analytic
Task: Common

Event ID 3043: EAP Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), vendorType(VendorType), error(ErrorString).

Channel: Analytic
Task: Common

Message #

EAP Exception caught: authorId(%1), type(%2), vendorId(%3), vendorType(%4), error(%5)

Fields #

Name	Description
`AuthorId` UInt32
`TypeId` UInt8
`VendorId` UInt32
`VendorType` UInt32
`ErrorString` UnicodeString

Event ID 3044: Exception caught: authorId(AuthorId), type(TypeId), vendorId(VendorId), vendorType(VendorType), error(ErrorString).

Channel: Analytic
Task: Common

Message #

Exception caught: authorId(%1), type(%2), vendorId(%3), vendorType(%4), error(%5)

Fields #

Name	Description
`AuthorId` UInt32
`TypeId` UInt8
`VendorId` UInt32
`VendorType` UInt32
`ErrorString` UnicodeString

Event ID 3045: Error ErrorCode, reading EAP method friendly name(muiRead).

Channel: Analytic
Task: Common

Description

Error ErrorCode, reading EAP method friendly name(muiRead). Friendly name retrieved from registry.

Message #

Error %1, reading EAP method friendly name(muiRead). Friendly name retrieved from registry

Fields #

Name	Description
`ErrorCode` UInt8

Event ID 3046: EAP method not found, re-initializing the library manager's EapMethodList data

Channel: Analytic
Task: Common

Event ID 3047: New method found after re-initializing EapMethodList data

Channel: Analytic
Task: Common

Event ID 3048: New EAP method added to EapMethodList: TypeId=TypeId, AuthorId=AuthorId, VendorId=VendorId, VendorType=VendorType.

Channel: Analytic
Task: Common

Message #

New EAP method added to EapMethodList: TypeId=%1, AuthorId=%2, VendorId=%3, VendorType=%4

Fields #

Name	Description
`TypeId` UInt8
`AuthorId` UInt32
`VendorId` UInt32
`VendorType` UInt32

Event ID 4001: debugString.

Channel: Debug

Message #

%1

Fields #

Name	Description
`debugString` AnsiString

Event ID 4002: debugString.

Channel: Debug

Message #

%1

Fields #

Name	Description
`debugString` AnsiString

Provenance

ETW provider GUID 6eb8db94-fe96-443f-a366-5fe0cee7fb1c

Defined in eapsvc.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB