Microsoft-Windows-EapMethods-RasTls

Event	Title	Channel	Sample	Rule
100	Authentication succeeded for EAP method type uint1.	Operational	N	N
101	Authentication failed for EAP method type uint1.	Operational	N	N
102	Authentication failed for EAP method type uint1 due to a revoked certificate.	Operational	N	N
103	Authentication failed for EAP method type uint1 due to an expired certificate.	Operational	N	N
104	Authentication failed for EAP method type uint1 because the certificate chain …	Operational	N	N
105	Deleting cached credentials as authentication failed for EAP method type uint1.	Operational	N	N
106	EAP session has been initialized to save user data.	Operational	N	N
107	Server Certificate Thumbprint: CAThumbprint.	Operational	N	N

Event ID 100: Authentication succeeded for EAP method type uint1.

Channel: Operational
Task: RasTlsauthenticationsucceededevent

Message #

Authentication succeeded for EAP method type %1.

Fields #

Name	Description
`uint1` UInt32

Event ID 101: Authentication failed for EAP method type uint1.

Channel: Operational
Task: RasTlsauthenticationfailedevent

Description

Authentication failed for EAP method type uint1. The error was uint2.

Message #

Authentication failed for EAP method type %1. The error was %2.

Fields #

Name	Description
`uint1` UInt32
`uint2` UInt32

Event ID 102: Authentication failed for EAP method type uint1 due to a revoked certificate.

Channel: Operational
Task: RasTlsauthenticationfailedevent

Description

Authentication failed for EAP method type uint1 due to a revoked certificate. The error was uint2.

Message #

Authentication failed for EAP method type %1 due to a revoked certificate. The error was %2.

Fields #

Name	Description
`uint1` UInt32
`uint2` UInt32

Event ID 103: Authentication failed for EAP method type uint1 due to an expired certificate.

Channel: Operational
Task: RasTlsauthenticationfailedevent

Description

Authentication failed for EAP method type uint1 due to an expired certificate. The error was uint2.

Message #

Authentication failed for EAP method type %1 due to an expired certificate. The error was %2.

Fields #

Name	Description
`uint1` UInt32
`uint2` UInt32

Event ID 104: Authentication failed for EAP method type uint1 because the certificate chain was issued by an authority that is not trusted.

Channel: Operational
Task: RasTlsauthenticationfailedevent

Description

Authentication failed for EAP method type uint1 because the certificate chain was issued by an authority that is not trusted. The error was uint2.

Message #

Authentication failed for EAP method type %1 because the certificate chain was issued by an authority that is not trusted. The error was %2.

Fields #

Name	Description
`uint1` UInt32
`uint2` UInt32

Event ID 105: Deleting cached credentials as authentication failed for EAP method type uint1.

Channel: Operational
Task: RasTlsauthenticationfailedevent

Message #

Deleting cached credentials as authentication failed for EAP method type %1.

Fields #

Name	Description
`uint1` UInt32

Event ID 106: EAP session has been initialized to save user data.

Channel: Operational
Task: RasTlsauthenticationinprogressevent

Event ID 107: Server Certificate Thumbprint: CAThumbprint.

Channel: Operational
Task: RasTlsauthenticationinprogressevent

Description

Server Certificate Thumbprint: CAThumbprint. Server Certificate Fully Qualified Domain Name: ServerName.

Message #

Server Certificate Thumbprint: %1. Server Certificate Fully Qualified Domain Name: %2.

Fields #

Name	Description
`CAThumbprint` UnicodeString
`ServerName` UnicodeString

Provenance

ETW provider GUID 9cc0413e-5717-4af5-82eb-6103d8707b45

Defined in RasTls.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB