Microsoft-Windows-HelloForBusiness

181 events across 2 channels

Event	Title	Channel	Sample
3045	Windows Hello processing started.	Operational	N
3052	The key pre-generation pool received a request for a new key.	Debug	N
3052	The key pre-generation pool received a request for a new key.	Operational	N
3053	The key pre-generation pool needs to pre-generate a key.	Debug	N
3053	The key pre-generation pool needs to pre-generate a key.	Operational	N
3054	Windows Hello for Business prerequisites check started.	Debug	Y
3054	Windows Hello for Business prerequisites check started.	Operational	Y
3055	Windows Hello container provisioning started.	Operational	N
3060	Windows Hello is creating a PIN recovery key for user UserSid.	Debug	N
3060	Windows Hello is creating a PIN recovery key for user .	Operational	N
3065	The cloud experience host started.	Operational	N
3066	Windows Hello sign-in certificate enrollment started.	Operational	N
3130	Windows Hello PIN Recovery is attempting to change user's PIN.	Debug	N
3130	Windows Hello PIN Recovery is attempting to change user's PIN.	Operational	N
3225	Windows Hello key creation started.	Operational	N
3510	Windows Hello key registration started.	Operational	N
3520	Attempting multi-factor unlock using provider Group_A.	Operational	N
3525	AD/Azure AD plugin request started.	Operational	N
3555	Windows Hello container creation started.	Operational	N
3601	Windows Hello container deletion started in response to a policy change.	Operational	N
3611	Windows Hello container deletion started from CallingAppName.	Operational	N
5000	TPM Manufacturer: TPM_Manufacturer.	Operational	N
5001	A user signed into the device with the following information.	Operational	N
5002	A user is signing into the device with the following gesture information.	Operational	N
5003	Windows Hello for Business Policy Enforcement Information for the user UserSid.	Operational	N
5004	Windows Hello for Business Enabled Policy successfully enforced for the user …	Operational	N
5005	Enforcing the following Windows Hello for Business Enable Policies for the user …	Debug	N
5005	Event ID 5005	Operational	N
5050	The key pre-generation pool received a request.	Debug	N
5050	The key pre-generation pool received a request.	Operational	N
5055	Windows Hello is validating that the device can satisfy all applicable policies.	Operational	N
5060	Windows Hello is checking the PIN recovery policy.	Debug	N
5060	Windows Hello is checking the PIN recovery policy.	Operational	N
5061	Windows Hello is downloading the public encryption key from the PIN recovery …	Debug	N
5061	Windows Hello is downloading the public encryption key from the PIN recovery …	Operational	N
5062	Windows Hello found a PIN recovery key for user UserSid.	Debug	N
5062	Windows Hello found a PIN recovery key for user .	Operational	N
5063	Windows Hello is updating the PIN recovery key for user UserSid.	Debug	N
5063	Windows Hello is updating the PIN recovery key for user .	Operational	N
5064	Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery …	Debug	N
5064	Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery …	Operational	N
5204	Windows Hello for Business certificate enrollment configurations.	Debug	N
5204	Windows Hello for Business certificate enrollment configurations.	Operational	N
5205	Windows Hello for Business On-Premise authentication configurations.	Operational	Y
5225	Creating a KeyProvider Windows Hello key with result Result.	Operational	N
5520	Multi-factor unlock policy is not configured on this device.	Operational	Y
5555	Windows Hello is validating that the device can satisfy all applicable policies.	Operational	N
5601	Windows Hello detected and ignored a policy change to delete the container at …	Operational	N
5602	Windows Hello was unable to check if there was a policy change that would …	Operational	N
5641	Windows Hello successfully updated a Key_Name KeyProvider key from the Windows …	Operational	N
5701	Windows Hello read following protector properties from disk: PIN protector = Hr, …	Operational	N
5702	Windows Hello wrote following protector properties to disk: PIN protector = Hr, …	Operational	N
6010	A key credential was unavailable for use by an application because it did not …	Operational	N
6045	Windows Hello processing stopped with warning Processing_time.	Operational	N
6055	Windows Hello container provisioning stopped with warning Processing_time.	Operational	N
6065	The cloud experience host scenario stopped with warning Processing_time.	Operational	N
6066	Windows Hello sign-in certificate enrollment was unable to enroll for a logon …	Operational	N
6209	Windows Hello for Business was unable to evaluate the presence of a certificate …	Debug	N
6209	Windows Hello for Business was unable to evaluate the presence of a certificate …	Operational	N
6210	Windows Hello for Business was unable to detect whether the user is running in a …	Debug	N
6210	Windows Hello for Business was unable to detect whether the user is running in a …	Operational	N
6441	Windows Hello for Business certificate trust and cloud trust policies are both …	Operational	N
6520	Provider is not in the acceptable provider list.	Operational	N
6525	AD/Azure AD plugin request stopped with warning Processing_time.	Operational	N
6611	Windows Hello could not delete the container as no container currently exists …	Operational	N
7001	A user failed to sign into the device with the following information.	Operational	N
7002	Failed to load an existing Windows Hello container.	Operational	N
7025	The Error service failed to start.	Operational	N
7030	Windows Hello failed to create the sign-in certificate request.	Operational	N
7031	Windows Hello failed to install the sign-in certificate.	Operational	N
7032	Windows Hello failed to roll back from an unsuccessful sign-in certificate …	Operational	N
7045	Windows Hello processing failed with Processing_time.	Operational	N
7052	The new key request from the key pre-generation pool failed.	Debug	N
7052	The new key request from the key pre-generation pool failed.	Operational	N
7053	The key pre-generation pool failed to pre-generate a key.	Debug	N
7053	The key pre-generation pool failed to pre-generate a key.	Operational	N
7054	Windows Hello for Business prerequisites check failed.	Debug	Y
7054	Windows Hello for Business prerequisites check failed.	Operational	Y
7055	Windows Hello container provisioning failed with Processing_time.	Operational	N
7060	Windows Hello failed to create a PIN recovery key for user Error.	Operational	N
7065	The cloud experience host scenario failed with Processing_time.	Operational	N
7066	Windows Hello sign-in certificate enrollment failed.	Operational	N
7067	Windows Hello failed to set a certificate property on a Windows Hello key.	Operational	N
7130	Windows Hello PIN Recovery failed to change the user's PIN.	Operational	N
7200	The device registration prerequisite check failed.	Debug	N
7200	The device registration prerequisite check failed.	Operational	N
7201	The Primary Account Primary Refresh Token prerequisite check failed.	Debug	N
7201	The Primary Account Primary Refresh Token prerequisite check failed.	Operational	Y
7202	The device failed to meet the Windows Hello for Business hardware requirements.	Debug	N
7202	The device failed to meet the Windows Hello for Business hardware requirements.	Operational	N
7203	Windows Hello for Business is not enabled.	Debug	N
7203	Windows Hello for Business is not enabled.	Operational	N
7204	Windows Hello for Business post-logon provisioning is not enabled.	Debug	N
7204	Windows Hello for Business post-logon provisioning is not enabled.	Operational	N
7205	Windows Hello for Business failed to locate a usable sign-in certificate …	Debug	N
7205	Windows Hello for Business failed to locate a usable sign-in certificate …	Operational	N
7206	Windows Hello for Business failed to locate a certificate registration …	Debug	N
7206	Windows Hello for Business failed to locate a certificate registration …	Operational	N
7207	Windows Hello for Business failed to locate an enterprise management client.	Debug	N
7207	Windows Hello for Business failed to locate an enterprise management client.	Operational	N
7208	Windows Hello for Business failed to locate a sign-in certificate profile.	Debug	N
7208	Windows Hello for Business failed to locate a sign-in certificate profile.	Operational	N
7209	Windows Hello for Business failed to locate a certificate payload for the …	Debug	N
7209	Windows Hello for Business failed to locate a certificate payload for the …	Operational	N
7210	Windows Hello for Business detected the user running in a remote desktop …	Debug	Y
7210	Windows Hello for Business detected the user running in a remote desktop …	Operational	Y
7211	The Secondary Account Primary Refresh Token prerequisite check failed.	Debug	N
7211	The Secondary Account Primary Refresh Token prerequisite check failed.	Operational	N
7225	Windows Hello key creation failed with Processing_time.	Operational	N
7226	Windows Hello failed to delete the Key_Name key.	Operational	N
7510	Windows Hello key registration failed.	Operational	N
7520	Failed to authenticate the user's credential.	Operational	N
7525	AD/Azure AD plugin request failed with Processing_time.	Operational	N
7555	Windows Hello container creation failed.	Operational	N
7601	Windows Hello failed to delete the container in response to a policy change.	Operational	N
7611	Windows Hello failed to delete the container.	Operational	N
7621	Windows Hello failed to delete the user's Windows Hello certificates.	Operational	N
7631	Windows Hello failed to delete the user's biometric enrollments.	Operational	N
7701	Windows Hello failed to use secure biometrics protector due to secret encryption …	Operational	N
7703	Windows Hello operation failed because the Windows Hello for Business policy is …	Operational	N
8002	Successfully loaded an existing KeyProvider Windows Hello container.	Operational	N
8025	The ServiceName service started successfully.	Operational	Y
8030	Windows Hello created the sign-in certificate request successfully.	Operational	N
8031	Windows Hello installed the sign-in certificate successfully.	Operational	N
8032	Windows Hello successfully rolled back from an unsuccessful sign-in certificate …	Operational	N
8045	Windows Hello processing completed successfully.	Operational	N
8052	The new key request from the key pre-generation pool completed successfully.	Debug	N
8052	The new key request from the key pre-generation pool completed successfully.	Operational	N
8053	The key pre-generation pool successfully pre-generated a key.	Debug	N
8053	The key pre-generation pool successfully pre-generated a key.	Operational	N
8054	Windows Hello for Business prerequisites check completed successfully.	Debug	Y
8054	Windows Hello for Business prerequisites check completed successfully.	Operational	Y
8055	Windows Hello container provisioning completed successfully.	Operational	N
8060	Windows Hello successfully created a PIN recovery key for user Processing_time.	Operational	N
8065	The cloud experience host completed successfully.	Operational	N
8066	Windows Hello sign-in certificate enrollment completed successfully.	Operational	N
8067	Windows Hello set a certificate property on a Windows Hello key.	Operational	N
8130	Windows Hello PIN Recovery successfully changed the user's PIN.	Operational	N
8200	The device registration prerequisite check completed successfully.	Debug	N
8200	The device registration prerequisite check completed successfully.	Operational	N
8201	The Primary Account Primary Refresh Token prerequisite check completed …	Debug	N
8201	The Primary Account Primary Refresh Token prerequisite check completed …	Operational	N
8202	The device meets Windows Hello for Business hardware requirements.	Debug	N
8202	The device meets Windows Hello for Business hardware requirements.	Operational	N
8203	Windows Hello for Business is enabled.	Debug	N
8203	Windows Hello for Business is enabled.	Operational	N
8204	Windows Hello for Business post-logon provisioning is enabled.	Debug	N
8204	Windows Hello for Business post-logon provisioning is enabled.	Operational	N
8205	Windows Hello for Business successfully located a usable sign-on certificate …	Debug	N
8205	Windows Hello for Business successfully located a usable sign-on certificate …	Operational	N
8206	Windows Hello for Business successfully located a certificate registration …	Debug	N
8206	Windows Hello for Business successfully located a certificate registration …	Operational	N
8207	Windows Hello for Business successfully located an enterprise management client.	Debug	N
8207	Windows Hello for Business successfully located an enterprise management client.	Operational	N
8208	Windows Hello for Business successfully located a sign-in certificate profile.	Debug	N
8208	Windows Hello for Business successfully located a sign-in certificate profile.	Operational	N
8209	Windows Hello for Business successfully located a certificate payload for the …	Debug	N
8209	Windows Hello for Business successfully located a certificate payload for the …	Operational	N
8210	Windows Hello for Business successfully completed the remote desktop …	Debug	Y
8210	Windows Hello for Business successfully completed the remote desktop …	Operational	Y
8211	The Secondary Account Primary Refresh Token prerequisite check completed …	Debug	N
8211	The Secondary Account Primary Refresh Token prerequisite check completed …	Operational	N
8225	Windows Hello key creation completed successfully.	Operational	N
8226	Windows Hello successfully deleted a Key_Name KeyProvider key from the Windows …	Operational	N
8510	Windows Hello key registration completed successfully.	Operational	N
8520	Successfully authenticated the user's credential.	Operational	N
8525	AD/Azure AD plugin request completed successfully.	Operational	N
8555	The Windows Hello container creation completed successfully.	Operational	N
8601	Windows Hello successfully deleted the container in response to a policy change.	Operational	N
8611	Windows Hello successfully deleted the container.	Operational	N
8621	Windows Hello successfully deleted the user's Windows Hello certificates.	Operational	N
8631	Windows Hello successfully deleted the user's biometric enrollments.	Operational	N
8632	Windows Hello for Business successfully added a user entry to the Username/SID …	Operational	N
8633	Windows Hello for Business successfully removed a user entry to the Username/SID …	Operational	N
8634	Windows Hello for Business found a user entry with a duplicate SID and …	Operational	N
8635	Windows Hello for Business found a user entry with a duplicate username and …	Operational	N
8636	Windows Hello for Business found a stale SID in the Username/SID cache.	Operational	N
8637	Windows Hello for Business found a stale username in the Username/SID cache.	Operational	N
8638	Windows Hello for Business removed a stale SID from the Username/SID cache: …	Operational	N
8639	Windows Hello for Business removed a stale username from the Username/SID cache.	Operational	N
8640	Windows Hello for Business PIN was changed by a user with the following …	Operational	N

Event ID 3045: Windows Hello processing started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Start

Description

Windows Hello processing started.

Message #

Windows Hello processing started.
Scenario type: %1

Fields #

Name	Description
`HelloScenarioType` UInt32

Event ID 3052: The key pre-generation pool received a request for a new key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: KeyCreation
Opcode: Start

Description

The key pre-generation pool received a request for a new key.

Message #

The key pre-generation pool received a request for a new key.

Event ID 3052: The key pre-generation pool received a request for a new key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Start

Description

The key pre-generation pool received a request for a new key.

Message #

The key pre-generation pool received a request for a new key.

Event ID 3053: The key pre-generation pool needs to pre-generate a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: KeyCreation
Opcode: Start

Description

The key pre-generation pool needs to pre-generate a key.

Message #

The key pre-generation pool needs to pre-generate a key.

Event ID 3053: The key pre-generation pool needs to pre-generate a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Start

Description

The key pre-generation pool needs to pre-generate a key.

Message #

The key pre-generation pool needs to pre-generate a key.

Event ID 3054: Windows Hello for Business prerequisites check started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Start

Description

Windows Hello for Business prerequisites check started.

Message #

Windows Hello for Business prerequisites check started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 3054,
    "level": "Information",
    "task": "Prerequisites Check",
    "opcode": "Start",
    "time_created": "2026-04-23T15:41:39.4152735+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 3054: Windows Hello for Business prerequisites check started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Informational
Task: PrerequisitesCheck
Opcode: Start

Description

Windows Hello for Business prerequisites check started.

Message #

Windows Hello for Business prerequisites check started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 3054,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 10,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598880+00:00",
    "event_record_id": 67,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business prerequisites check started."
}

Event ID 3055: Windows Hello container provisioning started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Start

Description

Windows Hello container provisioning started.

Message #

Windows Hello container provisioning started.

Event ID 3060: Windows Hello is creating a PIN recovery key for user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Start

Description

Windows Hello is creating a PIN recovery key for user UserSid.

Message #

Windows Hello is creating a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 3060: Windows Hello is creating a PIN recovery key for user .

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Start

Description

Windows Hello is creating a PIN recovery key for user .

Message #

Windows Hello is creating a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 3065: The cloud experience host started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Start

Description

The cloud experience host started.

Message #

The cloud experience host started.
Scenario type: %1

Fields #

Name	Description
`HelloScenarioType` UInt32

Event ID 3066: Windows Hello sign-in certificate enrollment started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: CertificateEnrollment
Opcode: Start

Description

Windows Hello sign-in certificate enrollment started.

Message #

Windows Hello sign-in certificate enrollment started.

Event ID 3130: Windows Hello PIN Recovery is attempting to change user's PIN.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Start

Description

Windows Hello PIN Recovery is attempting to change user's PIN. PIN recovery type: PinRecoveryEntryType.

Message #

Windows Hello PIN Recovery is attempting to change user's PIN. PIN recovery type: %1.

Fields #

Name	Description
`PinRecoveryEntryType` UInt32

Event ID 3130: Windows Hello PIN Recovery is attempting to change user's PIN.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Start

Description

Windows Hello PIN Recovery is attempting to change user's PIN. PIN recovery type: .

Message #

Windows Hello PIN Recovery is attempting to change user&apos;s PIN. PIN recovery type: %1.

Fields #

Name	Description
`PinRecoveryEntryType` UInt32

Event ID 3225: Windows Hello key creation started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Start

Description

Windows Hello key creation started.

Message #

Windows Hello key creation started.

Event ID 3510: Windows Hello key registration started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyRegistration
Opcode: Start

Description

Windows Hello key registration started.

Message #

Windows Hello key registration started.

Event ID 3520: Attempting multi-factor unlock using provider Group_A.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Multi_FactorUnlock
Opcode: Start

Description

Attempting multi-factor unlock using provider Group_A. The list of acceptable providers are.

Message #

Attempting multi-factor unlock using provider %1. The list of acceptable providers are:
Group A: %2
Group B: %3

Fields #

Name	Description
`MultiFactorUnlockProvider` UnicodeString
`MultiFactorUnlockGroupA` UnicodeString
`MultiFactorUnlockGroupB` UnicodeString

Event ID 3525: AD/Azure AD plugin request started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Start

Description

AD/Azure AD plugin request started.

Message #

AD/Azure AD plugin request started.

Event ID 3555: Windows Hello container creation started.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Start

Description

Windows Hello container creation started.

Message #

Windows Hello container creation started.

Event ID 3601: Windows Hello container deletion started in response to a policy change.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Start

Description

Windows Hello container deletion started in response to a policy change.

Message #

Windows Hello container deletion started in response to a policy change.

Event ID 3611: Windows Hello container deletion started from CallingAppName.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Start

Description

Windows Hello container deletion started from CallingAppName.

Message #

Windows Hello container deletion started from %1.

Fields #

Name	Description
`CallingAppName` UnicodeString

Event ID 5000: TPM Manufacturer: TPM_Manufacturer.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

TPM Manufacturer: TPM_Manufacturer.

Message #

TPM Manufacturer: %1
Version: %2
Firmware Version: %3
Is Ready: %4

Fields #

Name	Description
`Manufacturer` UnicodeString
`Version` UnicodeString
`FirmareVersion` UnicodeString
`IsReady` Boolean

Event ID 5001: A user signed into the device with the following information.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

A user signed into the device with the following information.

Message #

A user signed into the device with the following information:

Username: %1
User SID: %2
Credential Type: %3
Deployment Type: %4

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`DeploymentType` UInt32

Event ID 5002: A user is signing into the device with the following gesture information.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

A user is signing into the device with the following gesture information.

Message #

A user is signing into the device with the following gesture information:

Type: %1
Subtype: %2

Fields #

Name	Description
`GestureType` HexInt32
`GestureSubtype` UInt32

Event ID 5003: Windows Hello for Business Policy Enforcement Information for the user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Description

Windows Hello for Business Policy Enforcement Information for the user UserSid.

Message #

Windows Hello for Business Policy Enforcement Information for the user %1:

Use Windows Hello for Business Policy State: %2
 Use Windows Hello for Business Policy Source: %3
Deployment Type: %4
Credential Type: %5
PIN Min Length: %6
PIN Max Length: %7
PIN Uppercase: %8
PIN Lowercase: %9
PIN Digits: %10
PIN Special Characters: %11
PIN Allow Sequences: %12
PIN History: %13
PIN Expiration: %14
PIN Recovery Policy State: %15
TPM Required: %16
Hardware Policy: %17
Multifactor Unlock: %18

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`PinMinLength` UInt32
`PinMaxLength` UInt32
`PinUppercase` UInt32
`PinLowercase` UInt32
`PinDigits` UInt32
`PinSpecial` UInt32
`PinAllowSequences` Boolean
`PinHistory` Boolean
`PinExpiration` Boolean
`PinRecoveryPolicyState` UInt32
`TPMRequired` Boolean
`HardwarePolicy` UInt32
`MultifactorUnlock` Boolean

Event ID 5004: Windows Hello for Business Enabled Policy successfully enforced for the user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Description

Windows Hello for Business Enabled Policy successfully enforced for the user UserSid.

Message #

Windows Hello for Business Enabled Policy successfully enforced for the user %1:

Use Windows Hello for Business Policy State: %2

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32

Event ID 5005: Enforcing the following Windows Hello for Business Enable Policies for the user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PolicyEnforcement
Opcode: Informational

Description

Enforcing the following Windows Hello for Business Enable Policies for the user UserSid.

Message #

Enforcing the following Windows Hello for Business Enable Policies for the user %1:

Use Windows Hello for Business Policy State: %2
Use Windows Hello for Business Policy Source: %3
Deployment Type: %4

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32

Event ID 5005

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Description

Enforcing the following Windows Hello for Business Enable Policies for the user.

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32

Event ID 5050: The key pre-generation pool received a request.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: KeyCreation
Opcode: Informational

Description

The key pre-generation pool received a request.

Message #

The key pre-generation pool received a request.
Result: %1
Number of available keys: %2
Elapsed time: %3 seconds

Fields #

Name	Description
`Result` HexInt32
`NumberOfAvailableKeys` UInt32
`ElapsedTime` UInt32

Event ID 5050: The key pre-generation pool received a request.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Informational

Description

The key pre-generation pool received a request.

Message #

The key pre-generation pool received a request.__Result: %1__Number of available keys: %2__Elapsed time: %3 seconds

Fields #

Name	Description
`Result` HexInt32
`NumberOfAvailableKeys` UInt32
`ElapsedTime` UInt32

Event ID 5055: Windows Hello is validating that the device can satisfy all applicable policies.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational

Message #

Windows Hello is validating that the device can satisfy all applicable policies.TPM Supported: {TpmSupport}Hardware Policy: {HardwarePolicy}Exclude TPM 1.2: {IsTpm12Excluded}TPM Version: {TpmVersion}Secure TPM: {IsTpmSecure}Insecure TPM blocked by WHfB policy: {IsInsecureTpmBlockedByWHfBPolicy}Insecure TPM blocked by TPM policy: {IsInsecureTpmBlockedByTpmPolicy}Satisfactory TPM: {IsTpmSatisfactory}TPM FIPS: {IsTpmFIPS}TPM Locked Out: {TpmSupport}0Satisfactory Key Pregeneration Pool: {TpmSupport}1Key Storage Provider: {TpmSupport}2Result: {TpmSupport}3

Fields #

Name	Description
`TpmSupport`
`HardwarePolicy`
`IsTpm12Excluded`
`TpmVersion`
`IsTpmSecure`
`IsInsecureTpmBlockedByWHfBPolicy`
`IsInsecureTpmBlockedByTpmPolicy`
`IsTpmSatisfactory`
`IsTpmFIPS`

Event ID 5060: Windows Hello is checking the PIN recovery policy.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is checking the PIN recovery policy. The policy is PinRecoveryPolicyState for user UserSid.

Message #

Windows Hello is checking the PIN recovery policy. The policy is %1 for user %2.

Fields #

Name	Description
`PinRecoveryPolicyState` UInt32
`UserSid` SID

Event ID 5060: Windows Hello is checking the PIN recovery policy.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is checking the PIN recovery policy. The policy is for user .

Message #

Windows Hello is checking the PIN recovery policy. The policy is %1 for user %2.

Fields #

Name	Description
`PinRecoveryPolicyState` UInt32
`UserSid` SID

Event ID 5061: Windows Hello is downloading the public encryption key from the PIN recovery service.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is downloading the public encryption key from the PIN recovery service.

Message #

Windows Hello is downloading the public encryption key from the PIN recovery service.

Event ID 5061: Windows Hello is downloading the public encryption key from the PIN recovery service.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is downloading the public encryption key from the PIN recovery service.

Message #

Windows Hello is downloading the public encryption key from the PIN recovery service.

Event ID 5062: Windows Hello found a PIN recovery key for user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Informational

Description

Windows Hello found a PIN recovery key for user UserSid.

Message #

Windows Hello found a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5062: Windows Hello found a PIN recovery key for user .

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello found a PIN recovery key for user .

Message #

Windows Hello found a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5063: Windows Hello is updating the PIN recovery key for user UserSid.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is updating the PIN recovery key for user UserSid.

Message #

Windows Hello is updating the PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5063: Windows Hello is updating the PIN recovery key for user .

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is updating the PIN recovery key for user .

Message #

Windows Hello is updating the PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5064: Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Message #

Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Event ID 5064: Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Message #

Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service.

Event ID 5204: Windows Hello for Business certificate enrollment configurations.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business certificate enrollment configurations.

Message #

Windows Hello for Business certificate enrollment configurations: 

Certificate Enrollment Method: %1
Certificate Required for On-Premise Auth: %2

Fields #

Name	Description
`CertificateEnrollmentMethod` UInt32
`CertificateRequired` Boolean

Event ID 5204: Windows Hello for Business certificate enrollment configurations.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business certificate enrollment configurations.

Message #

Windows Hello for Business certificate enrollment configurations: ____Certificate Enrollment Method: %1__Certificate Required for On-Premise Auth: %2

Fields #

Name	Description
`CertificateEnrollmentMethod` UInt32
`CertificateRequired` Boolean

Event ID 5205: Windows Hello for Business On-Premise authentication configurations.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Informational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business On-Premise authentication configurations.

Message #

Windows Hello for Business On-Premise authentication configurations: 

Certificate Enrollment Method: %1
Certificate Required for On-Premise Auth: %2
Use Cloud Trust for On-Premise Auth: %3
Account has Cloud TGT: %4

Fields #

Name	Description
`CertificateEnrollmentMethod` UInt32
`CertificateRequired` Boolean
`UseCloudTrust` Boolean
`HasCloudTgt` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 5205,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-09T00:59:27.820700+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 9652,
      "thread_id": 9984
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "CertificateEnrollmentMethod": 0,
    "CertificateRequired": false,
    "UseCloudTrust": false,
    "HasCloudTgt": false
  },
  "message": ""
}

Event ID 5225: Creating a KeyProvider Windows Hello key with result Result.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Informational

Description

Creating a KeyProvider Windows Hello key with result Result.

Message #

Creating a %1 Windows Hello key with result %2.

Fields #

Name	Description
`KeyProvider` UInt32
`Result` HexInt32

Event ID 5520: Multi-factor unlock policy is not configured on this device.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Informational
Task: Multi_FactorUnlock
Opcode: Informational

Description

Multi-factor unlock policy is not configured on this device.

Message #

Multi-factor unlock policy is not configured on this device.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 5520,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:33:46.5624401+00:00",
    "event_record_id": 66,
    "correlation": {},
    "execution": {
      "process_id": 1112,
      "thread_id": 6076
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Device unlock policy is not configured on this device."
}

Event ID 5555: Windows Hello is validating that the device can satisfy all applicable policies.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Informational

Description

Windows Hello is validating that the device can satisfy all applicable policies.

Message #

Windows Hello is validating that the device can satisfy all applicable policies.

TPM Supported: %1
Hardware Policy: %2
Exclude TPM 1.2: %3
TPM Version: %4
TPM FIPS: %5
TPM Locked Out: %6
Satisfactory Key Pregeneration Pool: %7
Key Storage Provider: %8
Result: %9

Fields #

Name	Description
`TpmSupport` UInt32
`HardwarePolicy` UInt32
`IsTpm12Excluded` Boolean
`TpmVersion` UInt32
`IsTpmFIPS` Boolean
`IsTpmLockedOut` Boolean
`IsKeyPregenPoolSatisfactory` Boolean
`KeyProvider` UInt32
`Result` HexInt32

Event ID 5601: Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no pa...

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Informational

Description

Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no password on this device.

Message #

Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no password on this device.

Event ID 5602: Windows Hello was unable to check if there was a policy change that would trigger container deletion.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Informational

Description

Windows Hello was unable to check if there was a policy change that would trigger container deletion.

Message #

Windows Hello was unable to check if there was a policy change that would trigger container deletion.

Event ID 5641: Windows Hello successfully updated a Key_Name KeyProvider key from the Windows Hello container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyUpdate
Opcode: Informational

Description

Windows Hello successfully updated a Key_Name KeyProvider key from the Windows Hello container.

Message #

Windows Hello successfully updated a %1 %2 key from the Windows Hello container.

Key Name: %3

Fields #

Name	Description
`KeyProvider` UInt32
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString

Event ID 5701: Windows Hello read following protector properties from disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector ...

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ProtectorDiskIO
Opcode: Informational

Description

Windows Hello read following protector properties from disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector = SecureBioProtector, Preboot protector = RecoveryProtector.

Message #

Windows Hello read following protector properties from disk: PIN protector = %1, Bio protector = %2, Secure Bio Protector = %3, Recovery protector = %4, Preboot protector = %5

Fields #

Name	Description
`Hr` HexInt32
`PinProtector` Boolean
`BioProtector` Boolean
`SecureBioProtector` Boolean
`RecoveryProtector` Boolean
`PrebootProtector` Boolean

Event ID 5702: Windows Hello wrote following protector properties to disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector =...

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ProtectorDiskIO
Opcode: Informational

Description

Windows Hello wrote following protector properties to disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector = SecureBioProtector, Preboot protector = RecoveryProtector.

Message #

Windows Hello wrote following protector properties to disk: PIN protector = %1, Bio protector = %2, Secure Bio Protector = %3, Recovery protector = %4, Preboot protector = %5

Fields #

Name	Description
`Hr` HexInt32
`PinProtector` Boolean
`BioProtector` Boolean
`SecureBioProtector` Boolean
`RecoveryProtector` Boolean
`PrebootProtector` Boolean

Event ID 6010: A key credential was unavailable for use by an application because it did not meet all the requirements for use.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyUse
Opcode: Informational

Description

A key credential was unavailable for use by an application because it did not meet all the requirements for use.

Message #

A key credential was unavailable for use by an application because it did not meet all the requirements for use.

Key name: %1
Reason: %2

Fields #

Name	Description
`KeyName` UnicodeString
`KeyUseCredUnavailableReason` UInt32

Event ID 6045: Windows Hello processing stopped with warning Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

Windows Hello processing stopped with warning Processing_time.

Message #

Windows Hello processing stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6055: Windows Hello container provisioning stopped with warning Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Stop

Description

Windows Hello container provisioning stopped with warning Processing_time.

Message #

Windows Hello container provisioning stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6065: The cloud experience host scenario stopped with warning Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

The cloud experience host scenario stopped with warning Processing_time.

Message #

The cloud experience host scenario stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` UnicodeString
`ProcessingTime` UInt32

Event ID 6066: Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: CertificateEnrollment
Opcode: Stop

Description

Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate. Automatic certificate enrollment will retry at regular intervals.

Message #

Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate. Automatic certificate enrollment will retry at regular intervals.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6209: Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Message #

Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Event ID 6209: Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Message #

Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate.

Event ID 6210: Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Message #

Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Event ID 6210: Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Message #

Windows Hello for Business was unable to detect whether the user is running in a remote desktop session.

Event ID 6441: Windows Hello for Business certificate trust and cloud trust policies are both enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: QueryPolicy
Opcode: Informational

Description

Windows Hello for Business certificate trust and cloud trust policies are both enabled.

Message #

Windows Hello for Business certificate trust and cloud trust policies are both enabled.

Certificate trust policy will be enforced.

Event ID 6520: Provider is not in the acceptable provider list.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Multi_FactorUnlock
Opcode: Stop

Description

Provider is not in the acceptable provider list.

Message #

Provider is not in the acceptable provider list.

Event ID 6525: AD/Azure AD plugin request stopped with warning Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

AD/Azure AD plugin request stopped with warning Processing_time.

Message #

AD/Azure AD plugin request stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6611: Windows Hello could not delete the container as no container currently exists for the user.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Description

Windows Hello could not delete the container as no container currently exists for the user.

Message #

Windows Hello could not delete the container as no container currently exists for the user.

Event ID 7001: A user failed to sign into the device with the following information.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

A user failed to sign into the device with the following information.

Message #

A user failed to sign into the device with the following information:

Username: %1
User SID: %2
Credential Type: %3
Deployment Type: %4
Software Lockout Counter: %5
Authentication Error Status: %6
Authentication Error Substatus: %7

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`DeploymentType` UInt32
`SoftwareLockoutCounter` UInt32
`AuthenticationErrorStatus` HexInt32
`AuthenticationErrorSubStatus` HexInt32

Event ID 7002: Failed to load an existing Windows Hello container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerLoad
Opcode: Informational

Description

Failed to load an existing Windows Hello container.

Message #

Failed to load an existing Windows Hello container.

ID: %1
Error: %2

Fields #

Name	Description
`ContainerId` GUID
`Error` HexInt32

Event ID 7025: The Error service failed to start.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ServiceStart
Opcode: Informational

Description

The Error service failed to start.

Message #

The %1 service failed to start.
Error: %2.

Fields #

Name	Description
`ServiceName` UnicodeString
`Error` HexInt32

Event ID 7030: Windows Hello failed to create the sign-in certificate request.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello failed to create the sign-in certificate request.

Message #

Windows Hello failed to create the sign-in certificate request.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7031: Windows Hello failed to install the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello failed to install the sign-in certificate.

Message #

Windows Hello failed to install the sign-in certificate.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7032: Windows Hello failed to roll back from an unsuccessful sign-in certificate enrollment.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello failed to roll back from an unsuccessful sign-in certificate enrollment.

Message #

Windows Hello failed to roll back from an unsuccessful sign-in certificate enrollment.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7045: Windows Hello processing failed with Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

Windows Hello processing failed with Processing_time.

Message #

Windows Hello processing failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7052: The new key request from the key pre-generation pool failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: KeyCreation
Opcode: Stop

Description

The new key request from the key pre-generation pool failed.

Message #

The new key request from the key pre-generation pool failed.
Error: %1
Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7052: The new key request from the key pre-generation pool failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Stop

Description

The new key request from the key pre-generation pool failed.

Message #

The new key request from the key pre-generation pool failed.__Error: %1__Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7053: The key pre-generation pool failed to pre-generate a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: KeyCreation
Opcode: Stop

Description

The key pre-generation pool failed to pre-generate a key.

Message #

The key pre-generation pool failed to pre-generate a key.
Error: %1
Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7053: The key pre-generation pool failed to pre-generate a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Stop

Description

The key pre-generation pool failed to pre-generate a key.

Message #

The key pre-generation pool failed to pre-generate a key.__Error: %1__Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7054: Windows Hello for Business prerequisites check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Stop

Description

Windows Hello for Business prerequisites check failed.

Message #

Windows Hello for Business prerequisites check failed.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 7054,
    "level": "Error",
    "task": "Prerequisites Check",
    "opcode": "Stop",
    "time_created": "2026-04-18T01:58:47.6807755+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {
    "Error": "0x1"
  }
}

Event ID 7054: Windows Hello for Business prerequisites check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Stop

Description

Windows Hello for Business prerequisites check failed.

Message #

Windows Hello for Business prerequisites check failed.____Error: %1

Fields #

Name	Description
`Error` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7054,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 11,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T16:48:31.714659+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 4128,
      "thread_id": 4228
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "Error": "0x1"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7055: Windows Hello container provisioning failed with Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Stop

Description

Windows Hello container provisioning failed with Processing_time.

Message #

Windows Hello container provisioning failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7060: Windows Hello failed to create a PIN recovery key for user Error.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Stop

Description

Windows Hello failed to create a PIN recovery key for user Error.

Message #

Windows Hello failed to create a PIN recovery key for user %1.
Error: %2 (%3)
Correlation vector: %4
Processing time: %5 seconds.

Fields #

Name	Description
`UserSid` SID
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7065: The cloud experience host scenario failed with Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

The cloud experience host scenario failed with Processing_time.

Message #

The cloud experience host scenario failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` UnicodeString
`ProcessingTime` UInt32

Event ID 7066: Windows Hello sign-in certificate enrollment failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: CertificateEnrollment
Opcode: Stop

Description

Windows Hello sign-in certificate enrollment failed.

Message #

Windows Hello sign-in certificate enrollment failed.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7067: Windows Hello failed to set a certificate property on a Windows Hello key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: CertificateEnrollment
Opcode: Informational

Description

Windows Hello failed to set a certificate property on a Windows Hello key.

Message #

Windows Hello failed to set a certificate property on a Windows Hello key.

Error: %1
Key name: %2
Certificate type: %3

Fields #

Name	Description
`Error` HexInt32
`KeyName` UnicodeString
`CertificateType` UInt32

Event ID 7130: Windows Hello PIN Recovery failed to change the user's PIN.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PINRecovery
Opcode: Stop

Description

Windows Hello PIN Recovery failed to change the user's PIN.

Message #

Windows Hello PIN Recovery failed to change the user's PIN.
Error: %1 (%2)
Correlation vector: %3
Processing time: %4 seconds.

Fields #

Name	Description
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7200: The device registration prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

The device registration prerequisite check failed.

Message #

The device registration prerequisite check failed.

Event ID 7200: The device registration prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

The device registration prerequisite check failed.

Message #

The device registration prerequisite check failed.

Event ID 7201: The Primary Account Primary Refresh Token prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

The Primary Account Primary Refresh Token prerequisite check failed.

Message #

The Primary Account Primary Refresh Token prerequisite check failed.

Event ID 7201: The Primary Account Primary Refresh Token prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Informational

Description

The Primary Account Primary Refresh Token prerequisite check failed.

Message #

The Primary Account Primary Refresh Token prerequisite check failed.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7201,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T16:48:31.714659+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 4128,
      "thread_id": 4228
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7202: The device failed to meet the Windows Hello for Business hardware requirements.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

The device failed to meet the Windows Hello for Business hardware requirements.

Message #

The device failed to meet the Windows Hello for Business hardware requirements.

Event ID 7202: The device failed to meet the Windows Hello for Business hardware requirements.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

The device failed to meet the Windows Hello for Business hardware requirements.

Message #

The device failed to meet the Windows Hello for Business hardware requirements.

Event ID 7203: Windows Hello for Business is not enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business is not enabled.

Message #

Windows Hello for Business is not enabled.

Event ID 7203: Windows Hello for Business is not enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business is not enabled.

Message #

Windows Hello for Business is not enabled.

Event ID 7204: Windows Hello for Business post-logon provisioning is not enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business post-logon provisioning is not enabled.

Message #

Windows Hello for Business post-logon provisioning is not enabled.

Event ID 7204: Windows Hello for Business post-logon provisioning is not enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business post-logon provisioning is not enabled.

Message #

Windows Hello for Business post-logon provisioning is not enabled.

Event ID 7205: Windows Hello for Business failed to locate a usable sign-in certificate template.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a usable sign-in certificate template.

Message #

Windows Hello for Business failed to locate a usable sign-in certificate template.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7205: Windows Hello for Business failed to locate a usable sign-in certificate template.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a usable sign-in certificate template.

Message #

Windows Hello for Business failed to locate a usable sign-in certificate template.____Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7206: Windows Hello for Business failed to locate a certificate registration authority.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a certificate registration authority.

Message #

Windows Hello for Business failed to locate a certificate registration authority.

Event ID 7206: Windows Hello for Business failed to locate a certificate registration authority.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a certificate registration authority.

Message #

Windows Hello for Business failed to locate a certificate registration authority.

Event ID 7207: Windows Hello for Business failed to locate an enterprise management client.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate an enterprise management client.

Message #

Windows Hello for Business failed to locate an enterprise management client.

Event ID 7207: Windows Hello for Business failed to locate an enterprise management client.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate an enterprise management client.

Message #

Windows Hello for Business failed to locate an enterprise management client.

Event ID 7208: Windows Hello for Business failed to locate a sign-in certificate profile.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a sign-in certificate profile.

Message #

Windows Hello for Business failed to locate a sign-in certificate profile.

Event ID 7208: Windows Hello for Business failed to locate a sign-in certificate profile.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a sign-in certificate profile.

Message #

Windows Hello for Business failed to locate a sign-in certificate profile.

Event ID 7209: Windows Hello for Business failed to locate a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Message #

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Event ID 7209: Windows Hello for Business failed to locate a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Message #

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Event ID 7210: Windows Hello for Business detected the user running in a remote desktop session.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business detected the user running in a remote desktop session.

Message #

Windows Hello for Business detected the user running in a remote desktop session.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 7210,
    "level": "Error",
    "task": "Prerequisites Check",
    "opcode": "Informational",
    "time_created": "2026-04-18T01:58:47.6807742+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 7210: Windows Hello for Business detected the user running in a remote desktop session.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business detected the user running in a remote desktop session.

Message #

Windows Hello for Business detected the user running in a remote desktop session.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7210,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T04:58:41.296416+00:00",
    "event_record_id": 45,
    "correlation": {},
    "execution": {
      "process_id": 3604,
      "thread_id": 7852
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 7211: The Secondary Account Primary Refresh Token prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Description

The Secondary Account Primary Refresh Token prerequisite check failed.

Message #

The Secondary Account Primary Refresh Token prerequisite check failed.

Event ID 7211: The Secondary Account Primary Refresh Token prerequisite check failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

The Secondary Account Primary Refresh Token prerequisite check failed.

Message #

The Secondary Account Primary Refresh Token prerequisite check failed.

Event ID 7225: Windows Hello key creation failed with Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyCreation
Opcode: Stop

Description

Windows Hello key creation failed with Processing_time.

Message #

Windows Hello key creation failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7226: Windows Hello failed to delete the Key_Name key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyDeletion
Opcode: Informational

Description

Windows Hello failed to delete the Key_Name key.

Message #

Windows Hello failed to delete the %1 key.

Key Name: %2
Error: %3

Fields #

Name	Description
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString
`Error` HexInt32

Event ID 7510: Windows Hello key registration failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: KeyRegistration
Opcode: Stop

Description

Windows Hello key registration failed.

Message #

Windows Hello key registration failed.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7520: Failed to authenticate the user's credential.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Multi_FactorUnlock
Opcode: Stop

Description

Failed to authenticate the user's credential.

Message #

Failed to authenticate the user's credential.
Error: %1 (%2)
Correlation vector: %3
Processing time: %4 milliseconds.

Fields #

Name	Description
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7525: AD/Azure AD plugin request failed with Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Description

AD/Azure AD plugin request failed with Processing_time.

Message #

AD/Azure AD plugin request failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7555: Windows Hello container creation failed.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerCreation
Opcode: Stop

Description

Windows Hello container creation failed.

Message #

Windows Hello container creation failed.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7601: Windows Hello failed to delete the container in response to a policy change.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Description

Windows Hello failed to delete the container in response to a policy change.

Message #

Windows Hello failed to delete the container in response to a policy change.

Error: %1
Processing time: %2 milliseconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7611: Windows Hello failed to delete the container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Description

Windows Hello failed to delete the container.

Message #

Windows Hello failed to delete the container.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7621: Windows Hello failed to delete the user's Windows Hello certificates.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: CertificateEnrollment
Opcode: Informational

Description

Windows Hello failed to delete the user's Windows Hello certificates.

Message #

Windows Hello failed to delete the user's Windows Hello certificates.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7631: Windows Hello failed to delete the user's biometric enrollments.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: BiometricEnrollment
Opcode: Informational

Description

Windows Hello failed to delete the user's biometric enrollments.

Message #

Windows Hello failed to delete the user's biometric enrollments.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7701: Windows Hello failed to use secure biometrics protector due to secret encryption key loss.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: ProtectorUse
Opcode: Informational

Description

Windows Hello failed to use secure biometrics protector due to secret encryption key loss.

Message #

Windows Hello failed to use secure biometrics protector due to secret encryption key loss.

Event ID 7703: Windows Hello operation failed because the Windows Hello for Business policy is set to disabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PolicyEnforcement
Opcode: Stop

Description

Windows Hello operation failed because the Windows Hello for Business policy is set to disabled.

Message #

Windows Hello operation failed because the Windows Hello for Business policy is set to disabled.

Event ID 8002: Successfully loaded an existing KeyProvider Windows Hello container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Container Load
Opcode: Informational

Description

Successfully loaded an existing KeyProvider Windows Hello container.

Message #

Successfully loaded an existing %3 Windows Hello container.

ID: %1
Version: %2
Has Cached Logon Key: %4
State: %5

Fields #

Name	Description
`ContainerId` GUID
`ContainerVersion` UInt32
`KeyProvider` UInt32
`HasCachedLogonKey` Boolean
`ContainerStatus` UInt32

Event ID 8025: The ServiceName service started successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Success
Task: Service Start
Opcode: Informational

Description

The ServiceName service started successfully.

Message #

The %1 service started successfully.

Fields #

Name	Description
`ServiceName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8025,
    "version": 0,
    "level": 16,
    "task": 6,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-28T12:08:16.4045809+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 6132,
      "thread_id": 5148
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ServiceName": "Microsoft Passport Container"
  },
  "message": "The Microsoft Passport Container service started successfully."
}

Event ID 8030: Windows Hello created the sign-in certificate request successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello created the sign-in certificate request successfully.

Message #

Windows Hello created the sign-in certificate request successfully.

Event ID 8031: Windows Hello installed the sign-in certificate successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello installed the sign-in certificate successfully.

Message #

Windows Hello installed the sign-in certificate successfully.

Event ID 8032: Windows Hello successfully rolled back from an unsuccessful sign-in certificate enrollment.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Opcode: Informational

Description

Windows Hello successfully rolled back from an unsuccessful sign-in certificate enrollment.

Message #

Windows Hello successfully rolled back from an unsuccessful sign-in certificate enrollment.

Event ID 8045: Windows Hello processing completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Description

Windows Hello processing completed successfully.

Message #

Windows Hello processing completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8052: The new key request from the key pre-generation pool completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Key Creation
Opcode: Stop

Description

The new key request from the key pre-generation pool completed successfully.

Message #

The new key request from the key pre-generation pool completed successfully.
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8052: The new key request from the key pre-generation pool completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Key Creation
Opcode: Stop

Description

The new key request from the key pre-generation pool completed successfully.

Message #

The new key request from the key pre-generation pool completed successfully.__Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8053: The key pre-generation pool successfully pre-generated a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Key Creation
Opcode: Stop

Description

The key pre-generation pool successfully pre-generated a key.

Message #

The key pre-generation pool successfully pre-generated a key. 
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8053: The key pre-generation pool successfully pre-generated a key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Key Creation
Opcode: Stop

Description

The key pre-generation pool successfully pre-generated a key.

Message #

The key pre-generation pool successfully pre-generated a key. __Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8054: Windows Hello for Business prerequisites check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Stop

Description

Windows Hello for Business prerequisites check completed successfully.

Message #

Windows Hello for Business prerequisites check completed successfully.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 8054,
    "level": "Success",
    "task": "Prerequisites Check",
    "opcode": "Stop",
    "time_created": "2026-04-23T15:41:39.4152865+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 8054: Windows Hello for Business prerequisites check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Success
Task: Prerequisites Check
Opcode: Stop

Description

Windows Hello for Business prerequisites check completed successfully.

Message #

Windows Hello for Business prerequisites check completed successfully.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8054,
    "version": 0,
    "level": 16,
    "task": 12,
    "opcode": 11,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598987+00:00",
    "event_record_id": 69,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business prerequisites check completed successfully."
}

Event ID 8055: Windows Hello container provisioning completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Container Creation
Opcode: Stop

Description

Windows Hello container provisioning completed successfully.

Message #

Windows Hello container provisioning completed successfully.
Processing time: %1 seconds
Existing container: %2

Fields #

Name	Description
`ProcessingTime` UInt32
`UsedExistingContainer` Boolean

Event ID 8060: Windows Hello successfully created a PIN recovery key for user Processing_time.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PIN Recovery
Opcode: Stop

Description

Windows Hello successfully created a PIN recovery key for user Processing_time.

Message #

Windows Hello successfully created a PIN recovery key for user %1.
Processing time: %2 seconds

Fields #

Name	Description
`UserSid` SID
`ProcessingTime` UInt32

Event ID 8065: The cloud experience host completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Description

The cloud experience host completed successfully.

Message #

The cloud experience host completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8066: Windows Hello sign-in certificate enrollment completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Certificate Enrollment
Opcode: Stop

Description

Windows Hello sign-in certificate enrollment completed successfully.

Message #

Windows Hello sign-in certificate enrollment completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8067: Windows Hello set a certificate property on a Windows Hello key.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Certificate Enrollment
Opcode: Informational

Description

Windows Hello set a certificate property on a Windows Hello key.

Message #

Windows Hello set a certificate property on a Windows Hello key.

Key name: %1
Certificate type: %2

Fields #

Name	Description
`KeyName` UnicodeString
`CertificateType` UInt32

Event ID 8130: Windows Hello PIN Recovery successfully changed the user's PIN.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PIN Recovery
Opcode: Stop

Description

Windows Hello PIN Recovery successfully changed the user's PIN.

Message #

Windows Hello PIN Recovery successfully changed the user's PIN.
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8200: The device registration prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

The device registration prerequisite check completed successfully.

Message #

The device registration prerequisite check completed successfully.

Event ID 8200: The device registration prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

The device registration prerequisite check completed successfully.

Message #

The device registration prerequisite check completed successfully.

Event ID 8201: The Primary Account Primary Refresh Token prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

The Primary Account Primary Refresh Token prerequisite check completed successfully.

Message #

The Primary Account Primary Refresh Token prerequisite check completed successfully.

Event ID 8201: The Primary Account Primary Refresh Token prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

The Primary Account Primary Refresh Token prerequisite check completed successfully.

Message #

The Primary Account Primary Refresh Token prerequisite check completed successfully.

Event ID 8202: The device meets Windows Hello for Business hardware requirements.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

The device meets Windows Hello for Business hardware requirements.

Message #

The device meets Windows Hello for Business hardware requirements.

Event ID 8202: The device meets Windows Hello for Business hardware requirements.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

The device meets Windows Hello for Business hardware requirements.

Message #

The device meets Windows Hello for Business hardware requirements.

Event ID 8203: Windows Hello for Business is enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business is enabled.

Message #

Windows Hello for Business is enabled.

Event ID 8203: Windows Hello for Business is enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business is enabled.

Message #

Windows Hello for Business is enabled.

Event ID 8204: Windows Hello for Business post-logon provisioning is enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business post-logon provisioning is enabled.

Message #

Windows Hello for Business post-logon provisioning is enabled.

Event ID 8204: Windows Hello for Business post-logon provisioning is enabled.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business post-logon provisioning is enabled.

Message #

Windows Hello for Business post-logon provisioning is enabled.

Event ID 8205: Windows Hello for Business successfully located a usable sign-on certificate template.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a usable sign-on certificate template.

Message #

Windows Hello for Business successfully located a usable sign-on certificate template.

Event ID 8205: Windows Hello for Business successfully located a usable sign-on certificate template.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a usable sign-on certificate template.

Message #

Windows Hello for Business successfully located a usable sign-on certificate template.

Event ID 8206: Windows Hello for Business successfully located a certificate registration authority.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a certificate registration authority.

Message #

Windows Hello for Business successfully located a certificate registration authority.

Event ID 8206: Windows Hello for Business successfully located a certificate registration authority.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a certificate registration authority.

Message #

Windows Hello for Business successfully located a certificate registration authority.

Event ID 8207: Windows Hello for Business successfully located an enterprise management client.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located an enterprise management client.

Message #

Windows Hello for Business successfully located an enterprise management client.

Event ID 8207: Windows Hello for Business successfully located an enterprise management client.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located an enterprise management client.

Message #

Windows Hello for Business successfully located an enterprise management client.

Event ID 8208: Windows Hello for Business successfully located a sign-in certificate profile.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a sign-in certificate profile.

Message #

Windows Hello for Business successfully located a sign-in certificate profile.

Event ID 8208: Windows Hello for Business successfully located a sign-in certificate profile.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a sign-in certificate profile.

Message #

Windows Hello for Business successfully located a sign-in certificate profile.

Event ID 8209: Windows Hello for Business successfully located a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Message #

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Event ID 8209: Windows Hello for Business successfully located a certificate payload for the sign-in certificate.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Message #

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Event ID 8210: Windows Hello for Business successfully completed the remote desktop prerequisite check.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully completed the remote desktop prerequisite check.

Message #

Windows Hello for Business successfully completed the remote desktop prerequisite check.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 8210,
    "level": "Success",
    "task": "Prerequisites Check",
    "opcode": "Informational",
    "time_created": "2026-04-23T15:41:39.4152745+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 8210: Windows Hello for Business successfully completed the remote desktop prerequisite check.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Level: Success
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully completed the remote desktop prerequisite check.

Message #

Windows Hello for Business successfully completed the remote desktop prerequisite check.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8210,
    "version": 0,
    "level": 16,
    "task": 12,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598896+00:00",
    "event_record_id": 68,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business successfully completed the remote desktop prerequisite check."
}

Event ID 8211: The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Description

The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Message #

The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Event ID 8211: The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Prerequisites Check
Opcode: Informational

Description

The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Message #

The Secondary Account Primary Refresh Token prerequisite check completed successfully.

Event ID 8225: Windows Hello key creation completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Key Creation
Opcode: Stop

Description

Windows Hello key creation completed successfully.

Message #

Windows Hello key creation completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8226: Windows Hello successfully deleted a Key_Name KeyProvider key from the Windows Hello container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Key Deletion
Opcode: Informational

Description

Windows Hello successfully deleted a Key_Name KeyProvider key from the Windows Hello container.

Message #

Windows Hello successfully deleted a %1 %2 key from the Windows Hello container.

Key Name: %3

Fields #

Name	Description
`KeyProvider` UInt32
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString

Event ID 8510: Windows Hello key registration completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Key Registration
Opcode: Stop

Description

Windows Hello key registration completed successfully.

Message #

Windows Hello key registration completed successfully.

Event ID 8520: Successfully authenticated the user's credential.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Multi-Factor Unlock
Opcode: Stop

Description

Successfully authenticated the user's credential.

Message #

Successfully authenticated the user's credential.
Processing time: %1 milliseconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8525: AD/Azure AD plugin request completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Description

AD/Azure AD plugin request completed successfully.

Message #

AD/Azure AD plugin request completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8555: The Windows Hello container creation completed successfully.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Container Creation
Opcode: Stop

Description

The Windows Hello container creation completed successfully.

Message #

The Windows Hello container creation completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8601: Windows Hello successfully deleted the container in response to a policy change.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Container Deletion
Opcode: Stop

Description

Windows Hello successfully deleted the container in response to a policy change.

Message #

Windows Hello successfully deleted the container in response to a policy change.

Processing time: %1 milliseconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8611: Windows Hello successfully deleted the container.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Container Deletion
Opcode: Stop

Description

Windows Hello successfully deleted the container.

Message #

Windows Hello successfully deleted the container.

Event ID 8621: Windows Hello successfully deleted the user's Windows Hello certificates.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Certificate Enrollment
Opcode: Informational

Description

Windows Hello successfully deleted the user's Windows Hello certificates.

Message #

Windows Hello successfully deleted the user's Windows Hello certificates.

Event ID 8631: Windows Hello successfully deleted the user's biometric enrollments.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: BiometricEnrollment
Opcode: Informational

Description

Windows Hello successfully deleted the user's biometric enrollments.

Message #

Windows Hello successfully deleted the user's biometric enrollments.

Event ID 8632: Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information.

Message #

Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information: 

Username: %1
User SID: %2
Domain: %3
User-Entered: %4

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`Domain` UnicodeString	[Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information] Domain.
`UserEntered` Boolean	[Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information] User-Entered.

Event ID 8633: Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information: User SID.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information.

Message #

Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information: 

User SID: %1

Fields #

Name	Description
`UserSid` SID

Event ID 8634: Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache: User S...

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache.

Message #

Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache: 

User SID: %1
Username: %2
Unused Username: %3

Fields #

Name	Description
`UserSid` SID
`UserName` UnicodeString
`UnusedUserName` UnicodeString

Event ID 8635: Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache: Userna...

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache.

Message #

Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache: 

Username: %1
User SID: %2
Unused User SID: %3

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`UnusedUserSid` SID

Event ID 8636: Windows Hello for Business found a stale SID in the Username/SID cache.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a stale SID in the Username/SID cache.

Message #

Windows Hello for Business found a stale SID in the Username/SID cache: 

Username: %1
User SID: %2
Stale User SID: %3

Fields #

Name	Description
`UserName` UnicodeString
`CurrentlyMostRecentUserSid` SID
`StaleUserSid` SID

Event ID 8637: Windows Hello for Business found a stale username in the Username/SID cache.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a stale username in the Username/SID cache.

Message #

Windows Hello for Business found a stale username in the Username/SID cache: 

User SID: %1
Username: %2
Stale Username: %3

Fields #

Name	Description
`UserSid` SID
`CurrentlyMostRecentUserName` UnicodeString
`StaleUserName` UnicodeString

Event ID 8638: Windows Hello for Business removed a stale SID from the Username/SID cache: Stale User SID.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business removed a stale SID from the Username/SID cache.

Message #

Windows Hello for Business removed a stale SID from the Username/SID cache: 

Stale User SID: %1

Fields #

Name	Description
`StaleUserSid` SID

Event ID 8639: Windows Hello for Business removed a stale username from the Username/SID cache.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business removed a stale username from the Username/SID cache.

Message #

Windows Hello for Business removed a stale username from the Username/SID cache: 

User SID: %1
Stale Username: %2

Fields #

Name	Description
`UserSid` SID
`StaleUserName` UnicodeString

Event ID 8640: Windows Hello for Business PIN was changed by a user with the following information: User SID.

Provider: Microsoft-Windows-HelloForBusiness
Channel: Operational
Task: PIN Change
Opcode: Informational

Description

Windows Hello for Business PIN was changed by a user with the following information.

Message #

Windows Hello for Business PIN was changed by a user with the following information: 
User SID: %1

Fields #

Name	Description
`UserSid` SID

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 906b8a99-63ce-58d7-86ab-10989bbd5567

Defined in cryptngc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)