Microsoft-Windows-HelloForBusiness

Event	Title	Channel	Sample	Rule
3045	Windows Hello processing started.	Operational	N	N
3052	The key pre-generation pool received a request for a new key	Debug, Operational	N	N
3053	The key pre-generation pool needs to pre-generate a key	Debug, Operational	N	N
3054	Windows Hello for Business prerequisites check started.	Debug	Y	N
3054	Windows Hello for Business prerequisites check started.	Operational	Y	N
3055	Windows Hello container provisioning started.	Operational	N	N
3060	Windows Hello is creating a PIN recovery key for user UserSid.	Debug	N	N
3060	Windows Hello is creating a PIN recovery key for user .	Operational	N	N
3065	The cloud experience host started.	Operational	N	N
3066	Windows Hello sign-in certificate enrollment started.	Operational	N	N
3130	Windows Hello PIN Recovery is attempting to change user's PIN	Debug, Operational	N	N
3225	Windows Hello key creation started.	Operational	N	N
3510	Windows Hello key registration started.	Operational	N	N
3520	Attempting multi-factor unlock using provider Group_A.	Operational	N	N
3525	AD/Azure AD plugin request started.	Operational	N	N
3555	Windows Hello container creation started.	Operational	N	N
3601	Windows Hello container deletion started in response to a policy change.	Operational	N	N
3611	Windows Hello container deletion started from CallingAppName.	Operational	N	N
5000	TPM Manufacturer: TPM_Manufacturer.	Operational	Y	N
5001	A user signed into the device with the following information.	Operational	N	N
5002	A user is signing into the device with the following gesture information.	Operational	N	N
5003	Windows Hello for Business Policy Enforcement Information for the user UserSid.	Operational	N	N
5004	Windows Hello for Business Enabled Policy successfully enforced for the user …	Operational	N	N
5005	Enforcing the following Windows Hello for Business Enable Policies for the user …	Debug	N	N
5005	Event ID 5005	Operational	N	N
5050	The key pre-generation pool received a request	Debug, Operational	N	N
5055	Windows Hello is validating that the device can satisfy all applicable policies.	Operational	N	N
5060	Windows Hello is checking the PIN recovery policy	Debug, Operational	N	N
5061	Windows Hello is downloading the public encryption key from the PIN recovery …	Debug, Operational	N	N
5062	Windows Hello found a PIN recovery key for user UserSid.	Debug	N	N
5062	Windows Hello found a PIN recovery key for user .	Operational	N	N
5063	Windows Hello is updating the PIN recovery key for user UserSid.	Debug	N	N
5063	Windows Hello is updating the PIN recovery key for user .	Operational	N	N
5064	Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery …	Debug, Operational	N	N
5204	Windows Hello for Business certificate enrollment configurations	Debug, Operational	N	N
5205	Windows Hello for Business On-Premise authentication configurations.	Operational	Y	N
5225	Creating a KeyProvider Windows Hello key with result Result.	Operational	N	N
5520	Multi-factor unlock policy is not configured on this device.	Operational	Y	N
5555	Windows Hello is validating that the device can satisfy all applicable policies.	Operational	N	N
5601	Windows Hello detected and ignored a policy change to delete the container at …	Operational	N	N
5602	Windows Hello was unable to check if there was a policy change that would …	Operational	N	N
5641	Windows Hello successfully updated a Key_Name KeyProvider key from the Windows …	Operational	N	N
5701	Windows Hello read following protector properties from disk: PIN protector = Hr, …	Operational	N	N
5702	Windows Hello wrote following protector properties to disk: PIN protector = Hr, …	Operational	N	N
6010	A key credential was unavailable for use by an application because it did not …	Operational	N	N
6045	Windows Hello processing stopped with warning Processing_time.	Operational	N	N
6055	Windows Hello container provisioning stopped with warning Processing_time.	Operational	N	N
6065	The cloud experience host scenario stopped with warning Processing_time.	Operational	N	N
6066	Windows Hello sign-in certificate enrollment was unable to enroll for a logon …	Operational	N	N
6209	Windows Hello for Business was unable to evaluate the presence of a certificate …	Debug, Operational	N	N
6210	Windows Hello for Business was unable to detect whether the user is running in a …	Debug, Operational	N	N
6441	Windows Hello for Business certificate trust and cloud trust policies are both …	Operational	N	N
6520	Provider is not in the acceptable provider list.	Operational	N	N
6525	AD/Azure AD plugin request stopped with warning Processing_time.	Operational	N	N
6611	Windows Hello could not delete the container as no container currently exists …	Operational	N	N
7001	A user failed to sign into the device with the following information.	Operational	N	N
7002	Failed to load an existing Windows Hello container.	Operational	N	N
7025	The Error service failed to start.	Operational	N	N
7030	Windows Hello failed to create the sign-in certificate request.	Operational	N	N
7031	Windows Hello failed to install the sign-in certificate.	Operational	N	N
7032	Windows Hello failed to roll back from an unsuccessful sign-in certificate …	Operational	N	N
7045	Windows Hello processing failed with Processing_time.	Operational	N	N
7052	The new key request from the key pre-generation pool failed	Debug, Operational	N	N
7053	The key pre-generation pool failed to pre-generate a key	Debug, Operational	N	N
7054	Windows Hello for Business prerequisites check failed.	Debug	Y	N
7054	Windows Hello for Business prerequisites check failed.	Operational	Y	N
7055	Windows Hello container provisioning failed with Processing_time.	Operational	N	N
7060	Windows Hello failed to create a PIN recovery key for user Error.	Operational	N	N
7065	The cloud experience host scenario failed with Processing_time.	Operational	N	N
7066	Windows Hello sign-in certificate enrollment failed.	Operational	N	N
7067	Windows Hello failed to set a certificate property on a Windows Hello key.	Operational	N	N
7130	Windows Hello PIN Recovery failed to change the user's PIN.	Operational	N	N
7200	The device registration prerequisite check failed	Debug, Operational	N	N
7201	The Primary Account Primary Refresh Token prerequisite check failed	Debug, Operational	Y	N
7202	The device failed to meet the Windows Hello for Business hardware requirements	Debug, Operational	N	N
7203	Windows Hello for Business is not enabled	Debug, Operational	N	N
7204	Windows Hello for Business post-logon provisioning is not enabled	Debug, Operational	N	N
7205	Windows Hello for Business failed to locate a usable sign-in certificate …	Debug, Operational	N	N
7206	Windows Hello for Business failed to locate a certificate registration authority	Debug, Operational	N	N
7207	Windows Hello for Business failed to locate an enterprise management client	Debug, Operational	N	N
7208	Windows Hello for Business failed to locate a sign-in certificate profile	Debug, Operational	N	N
7209	Windows Hello for Business failed to locate a certificate payload for the …	Debug, Operational	N	N
7210	Windows Hello for Business detected the user running in a remote desktop …	Debug	Y	N
7210	Windows Hello for Business detected the user running in a remote desktop …	Operational	Y	N
7211	The Secondary Account Primary Refresh Token prerequisite check failed	Debug, Operational	N	N
7225	Windows Hello key creation failed with Processing_time.	Operational	N	N
7226	Windows Hello failed to delete the Key_Name key.	Operational	N	N
7510	Windows Hello key registration failed.	Operational	N	N
7520	Failed to authenticate the user's credential.	Operational	N	N
7525	AD/Azure AD plugin request failed with Processing_time.	Operational	N	N
7555	Windows Hello container creation failed.	Operational	N	N
7601	Windows Hello failed to delete the container in response to a policy change.	Operational	N	N
7611	Windows Hello failed to delete the container.	Operational	N	N
7621	Windows Hello failed to delete the user's Windows Hello certificates.	Operational	N	N
7631	Windows Hello failed to delete the user's biometric enrollments.	Operational	N	N
7701	Windows Hello failed to use secure biometrics protector due to secret encryption …	Operational	N	N
7703	Windows Hello operation failed because the Windows Hello for Business policy is …	Operational	N	N
8002	Successfully loaded an existing KeyProvider Windows Hello container.	Operational	N	N
8025	The ServiceName service started successfully.	Operational	Y	N
8030	Windows Hello created the sign-in certificate request successfully.	Operational	N	N
8031	Windows Hello installed the sign-in certificate successfully.	Operational	N	N
8032	Windows Hello successfully rolled back from an unsuccessful sign-in certificate …	Operational	N	N
8045	Windows Hello processing completed successfully.	Operational	N	N
8052	The new key request from the key pre-generation pool completed successfully	Debug, Operational	N	N
8053	The key pre-generation pool successfully pre-generated a key	Debug, Operational	N	N
8054	Windows Hello for Business prerequisites check completed successfully.	Debug	Y	N
8054	Windows Hello for Business prerequisites check completed successfully.	Operational	Y	N
8055	Windows Hello container provisioning completed successfully.	Operational	N	N
8060	Windows Hello successfully created a PIN recovery key for user Processing_time.	Operational	N	N
8065	The cloud experience host completed successfully.	Operational	N	N
8066	Windows Hello sign-in certificate enrollment completed successfully.	Operational	N	N
8067	Windows Hello set a certificate property on a Windows Hello key.	Operational	N	N
8130	Windows Hello PIN Recovery successfully changed the user's PIN.	Operational	N	N
8200	The device registration prerequisite check completed successfully	Debug, Operational	N	N
8201	The Primary Account Primary Refresh Token prerequisite check completed …	Debug, Operational	N	N
8202	The device meets Windows Hello for Business hardware requirements	Debug, Operational	N	N
8203	Windows Hello for Business is enabled	Debug, Operational	N	N
8204	Windows Hello for Business post-logon provisioning is enabled	Debug, Operational	N	N
8205	Windows Hello for Business successfully located a usable sign-on certificate …	Debug, Operational	N	N
8206	Windows Hello for Business successfully located a certificate registration …	Debug, Operational	N	N
8207	Windows Hello for Business successfully located an enterprise management client	Debug, Operational	N	N
8208	Windows Hello for Business successfully located a sign-in certificate profile	Debug, Operational	N	N
8209	Windows Hello for Business successfully located a certificate payload for the …	Debug, Operational	N	N
8210	Windows Hello for Business successfully completed the remote desktop …	Debug	Y	N
8210	Windows Hello for Business successfully completed the remote desktop …	Operational	Y	N
8211	The Secondary Account Primary Refresh Token prerequisite check completed …	Debug, Operational	N	N
8225	Windows Hello key creation completed successfully.	Operational	N	N
8226	Windows Hello successfully deleted a Key_Name KeyProvider key from the Windows …	Operational	N	N
8510	Windows Hello key registration completed successfully.	Operational	N	N
8520	Successfully authenticated the user's credential.	Operational	N	N
8525	AD/Azure AD plugin request completed successfully.	Operational	N	N
8555	The Windows Hello container creation completed successfully.	Operational	N	N
8601	Windows Hello successfully deleted the container in response to a policy change.	Operational	N	N
8611	Windows Hello successfully deleted the container.	Operational	N	N
8621	Windows Hello successfully deleted the user's Windows Hello certificates.	Operational	N	N
8631	Windows Hello successfully deleted the user's biometric enrollments.	Operational	N	N
8632	Windows Hello for Business successfully added a user entry to the Username/SID …	Operational	N	N
8633	Windows Hello for Business successfully removed a user entry to the Username/SID …	Operational	N	N
8634	Windows Hello for Business found a user entry with a duplicate SID and …	Operational	N	N
8635	Windows Hello for Business found a user entry with a duplicate username and …	Operational	N	N
8636	Windows Hello for Business found a stale SID in the Username/SID cache.	Operational	N	N
8637	Windows Hello for Business found a stale username in the Username/SID cache.	Operational	N	N
8638	Windows Hello for Business removed a stale SID from the Username/SID cache: …	Operational	N	N
8639	Windows Hello for Business removed a stale username from the Username/SID cache.	Operational	N	N
8640	Windows Hello for Business PIN was changed by a user with the following …	Operational	N	N

Event ID 3045: Windows Hello processing started.

Channel: Operational
Task: HelloProvisioning
Opcode: Start

Message #

Windows Hello processing started.
Scenario type: %1

Fields #

Name	Description
`HelloScenarioType` UInt32

Event ID 3052: The key pre-generation pool received a request for a new key

Channel: Debug, Operational
Task: KeyCreation
Opcode: Start

Event ID 3053: The key pre-generation pool needs to pre-generate a key

Channel: Debug, Operational
Task: KeyCreation
Opcode: Start

Event ID 3054: Windows Hello for Business prerequisites check started.

Channel: Debug
Task: PrerequisitesCheck
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 3054,
    "level": "Information",
    "task": "Prerequisites Check",
    "opcode": "Start",
    "time_created": "2026-04-23T15:41:39.4152735+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 3054: Windows Hello for Business prerequisites check started.

Channel: Operational
Level: Informational
Task: PrerequisitesCheck
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 3054,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 10,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598880+00:00",
    "event_record_id": 67,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business prerequisites check started."
}

Event ID 3055: Windows Hello container provisioning started.

Channel: Operational
Task: ContainerCreation
Opcode: Start

Event ID 3060: Windows Hello is creating a PIN recovery key for user UserSid.

Channel: Debug
Task: PINRecovery
Opcode: Start

Message #

Windows Hello is creating a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 3060: Windows Hello is creating a PIN recovery key for user .

Channel: Operational
Task: PINRecovery
Opcode: Start

Message #

Windows Hello is creating a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 3065: The cloud experience host started.

Channel: Operational
Task: HelloProvisioning
Opcode: Start

Message #

The cloud experience host started.
Scenario type: %1

Fields #

Name	Description
`HelloScenarioType` UInt32

Event ID 3066: Windows Hello sign-in certificate enrollment started.

Channel: Operational
Task: CertificateEnrollment
Opcode: Start

Event ID 3130: Windows Hello PIN Recovery is attempting to change user's PIN

Channel: Debug, Operational
Task: PINRecovery
Opcode: Start

Description

Windows Hello PIN Recovery is attempting to change user's PIN. PIN recovery type: PinRecoveryEntryType.

Message #

Windows Hello PIN Recovery is attempting to change user's PIN. PIN recovery type: %1.

Fields #

Name	Description
`PinRecoveryEntryType` UInt32

Event ID 3225: Windows Hello key creation started.

Channel: Operational
Task: KeyCreation
Opcode: Start

Event ID 3510: Windows Hello key registration started.

Channel: Operational
Task: KeyRegistration
Opcode: Start

Event ID 3520: Attempting multi-factor unlock using provider Group_A.

Channel: Operational
Task: Multi_FactorUnlock
Opcode: Start

Description

Attempting multi-factor unlock using provider Group_A. The list of acceptable providers are.

Message #

Attempting multi-factor unlock using provider %1. The list of acceptable providers are:
Group A: %2
Group B: %3

Fields #

Name	Description
`MultiFactorUnlockProvider` UnicodeString
`MultiFactorUnlockGroupA` UnicodeString
`MultiFactorUnlockGroupB` UnicodeString

Event ID 3525: AD/Azure AD plugin request started.

Channel: Operational
Task: HelloProvisioning
Opcode: Start

Event ID 3555: Windows Hello container creation started.

Channel: Operational
Task: ContainerCreation
Opcode: Start

Event ID 3601: Windows Hello container deletion started in response to a policy change.

Channel: Operational
Task: ContainerDeletion
Opcode: Start

Event ID 3611: Windows Hello container deletion started from CallingAppName.

Channel: Operational
Task: ContainerDeletion
Opcode: Start

Message #

Windows Hello container deletion started from %1.

Fields #

Name	Description
`CallingAppName` UnicodeString

Event ID 5000: TPM Manufacturer: TPM_Manufacturer.

Channel: Operational
Level: Informational
Opcode: Informational

Message #

TPM Manufacturer: %1
Version: %2
Firmware Version: %3
Is Ready: %4

Fields #

Name	Description
`Manufacturer` UnicodeString
`Version` UnicodeString
`FirmareVersion` UnicodeString
`IsReady` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906b8a99-63ce-58d7-86ab-10989bbd5567",
    "event_source_name": "",
    "event_id": 5000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2026-07-19T17:23:25.0549646+00:00",
    "event_record_id": 63,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 7968,
      "thread_id": 6280
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Manufacturer": "IBM",
    "Version": "2.0",
    "FirmareVersion": "8217.4131.22.13878",
    "IsReady": "true"
  },
  "message": "TPM Manufacturer: IBM\r\nVersion: 2.0\r\nFirmware Version: 8217.4131.22.13878\r\nIs Ready: true"
}

Event ID 5001: A user signed into the device with the following information.

Channel: Operational
Opcode: Informational

Message #

A user signed into the device with the following information:

Username: %1
User SID: %2
Credential Type: %3
Deployment Type: %4

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`DeploymentType` UInt32

Event ID 5002: A user is signing into the device with the following gesture information.

Channel: Operational
Opcode: Informational

Message #

A user is signing into the device with the following gesture information:

Type: %1
Subtype: %2

Fields #

Name	Description
`GestureType` HexInt32
`GestureSubtype` UInt32

Event ID 5003: Windows Hello for Business Policy Enforcement Information for the user UserSid.

Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Message #

Windows Hello for Business Policy Enforcement Information for the user %1:

Use Windows Hello for Business Policy State: %2
 Use Windows Hello for Business Policy Source: %3
Deployment Type: %4
Credential Type: %5
PIN Min Length: %6
PIN Max Length: %7
PIN Uppercase: %8
PIN Lowercase: %9
PIN Digits: %10
PIN Special Characters: %11
PIN Allow Sequences: %12
PIN History: %13
PIN Expiration: %14
PIN Recovery Policy State: %15
TPM Required: %16
Hardware Policy: %17
Multifactor Unlock: %18

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`PinMinLength` UInt32
`PinMaxLength` UInt32
`PinUppercase` UInt32
`PinLowercase` UInt32
`PinDigits` UInt32
`PinSpecial` UInt32
`PinAllowSequences` Boolean
`PinHistory` Boolean
`PinExpiration` Boolean
`PinRecoveryPolicyState` UInt32
`TPMRequired` Boolean
`HardwarePolicy` UInt32
`MultifactorUnlock` Boolean

Event ID 5004: Windows Hello for Business Enabled Policy successfully enforced for the user UserSid.

Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Message #

Windows Hello for Business Enabled Policy successfully enforced for the user %1:

Use Windows Hello for Business Policy State: %2

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32

Event ID 5005: Enforcing the following Windows Hello for Business Enable Policies for the user UserSid.

Channel: Debug
Task: PolicyEnforcement
Opcode: Informational

Message #

Enforcing the following Windows Hello for Business Enable Policies for the user %1:

Use Windows Hello for Business Policy State: %2
Use Windows Hello for Business Policy Source: %3
Deployment Type: %4

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32

Event ID 5005

Channel: Operational
Task: PolicyEnforcement
Opcode: Informational

Description

Enforcing the following Windows Hello for Business Enable Policies for the user.

Fields #

Name	Description
`UserSid` SID
`NgcEnabledPolicyState` UInt32
`EnabledPolicySource` UInt32
`DeploymentType` UInt32

Event ID 5050: The key pre-generation pool received a request

Channel: Debug, Operational
Task: KeyCreation
Opcode: Informational

Message #

The key pre-generation pool received a request.
Result: %1
Number of available keys: %2
Elapsed time: %3 seconds

Fields #

Name	Description
`Result` HexInt32
`NumberOfAvailableKeys` UInt32
`ElapsedTime` UInt32

Event ID 5055: Windows Hello is validating that the device can satisfy all applicable policies.

Channel: Operational

Message #

Windows Hello is validating that the device can satisfy all applicable policies.TPM Supported: {TpmSupport}Hardware Policy: {HardwarePolicy}Exclude TPM 1.2: {IsTpm12Excluded}TPM Version: {TpmVersion}Secure TPM: {IsTpmSecure}Insecure TPM blocked by WHfB policy: {IsInsecureTpmBlockedByWHfBPolicy}Insecure TPM blocked by TPM policy: {IsInsecureTpmBlockedByTpmPolicy}Satisfactory TPM: {IsTpmSatisfactory}TPM FIPS: {IsTpmFIPS}TPM Locked Out: {TpmSupport}0Satisfactory Key Pregeneration Pool: {TpmSupport}1Key Storage Provider: {TpmSupport}2Result: {TpmSupport}3

Fields #

Name	Description
`TpmSupport`
`HardwarePolicy`
`IsTpm12Excluded`
`TpmVersion`
`IsTpmSecure`
`IsInsecureTpmBlockedByWHfBPolicy`
`IsInsecureTpmBlockedByTpmPolicy`
`IsTpmSatisfactory`
`IsTpmFIPS`

Event ID 5060: Windows Hello is checking the PIN recovery policy

Channel: Debug, Operational
Task: PINRecovery
Opcode: Informational

Description

Windows Hello is checking the PIN recovery policy. The policy is PinRecoveryPolicyState for user UserSid.

Message #

Windows Hello is checking the PIN recovery policy. The policy is %1 for user %2.

Fields #

Name	Description
`PinRecoveryPolicyState` UInt32
`UserSid` SID

Event ID 5061: Windows Hello is downloading the public encryption key from the PIN recovery service

Channel: Debug, Operational
Task: PINRecovery
Opcode: Informational

Event ID 5062: Windows Hello found a PIN recovery key for user UserSid.

Channel: Debug
Task: PINRecovery
Opcode: Informational

Message #

Windows Hello found a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5062: Windows Hello found a PIN recovery key for user .

Channel: Operational
Task: PINRecovery
Opcode: Informational

Message #

Windows Hello found a PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5063: Windows Hello is updating the PIN recovery key for user UserSid.

Channel: Debug
Task: PINRecovery
Opcode: Informational

Message #

Windows Hello is updating the PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5063: Windows Hello is updating the PIN recovery key for user .

Channel: Operational
Task: PINRecovery
Opcode: Informational

Message #

Windows Hello is updating the PIN recovery key for user %1.

Fields #

Name	Description
`UserSid` SID

Event ID 5064: Windows Hello is uploading the encrypted PIN recovery key to the PIN recovery service

Channel: Debug, Operational
Task: PINRecovery
Opcode: Informational

Event ID 5204: Windows Hello for Business certificate enrollment configurations

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Message #

Windows Hello for Business certificate enrollment configurations: 

Certificate Enrollment Method: %1
Certificate Required for On-Premise Auth: %2

Fields #

Name	Description
`CertificateEnrollmentMethod` UInt32
`CertificateRequired` Boolean

Event ID 5205: Windows Hello for Business On-Premise authentication configurations.

Channel: Operational
Level: Informational
Task: PrerequisitesCheck
Opcode: Informational

Message #

Windows Hello for Business On-Premise authentication configurations: 

Certificate Enrollment Method: %1
Certificate Required for On-Premise Auth: %2
Use Cloud Trust for On-Premise Auth: %3
Account has Cloud TGT: %4

Fields #

Name	Description
`CertificateEnrollmentMethod` UInt32
`CertificateRequired` Boolean
`UseCloudTrust` Boolean
`HasCloudTgt` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 5205,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-09T00:59:27.820700+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 9652,
      "thread_id": 9984
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "CertificateEnrollmentMethod": 0,
    "CertificateRequired": false,
    "UseCloudTrust": false,
    "HasCloudTgt": false
  },
  "message": ""
}

Event ID 5225: Creating a KeyProvider Windows Hello key with result Result.

Channel: Operational
Task: KeyCreation
Opcode: Informational

Message #

Creating a %1 Windows Hello key with result %2.

Fields #

Name	Description
`KeyProvider` UInt32
`Result` HexInt32

Event ID 5520: Multi-factor unlock policy is not configured on this device.

Channel: Operational
Level: Informational
Task: Multi_FactorUnlock
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 5520,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:33:46.5624401+00:00",
    "event_record_id": 66,
    "correlation": {},
    "execution": {
      "process_id": 1112,
      "thread_id": 6076
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Device unlock policy is not configured on this device."
}

Event ID 5555: Windows Hello is validating that the device can satisfy all applicable policies.

Channel: Operational
Task: ContainerCreation
Opcode: Informational

Message #

Windows Hello is validating that the device can satisfy all applicable policies.

TPM Supported: %1
Hardware Policy: %2
Exclude TPM 1.2: %3
TPM Version: %4
TPM FIPS: %5
TPM Locked Out: %6
Satisfactory Key Pregeneration Pool: %7
Key Storage Provider: %8
Result: %9

Fields #

Name	Description
`TpmSupport` UInt32
`HardwarePolicy` UInt32
`IsTpm12Excluded` Boolean
`TpmVersion` UInt32
`IsTpmFIPS` Boolean
`IsTpmLockedOut` Boolean
`IsKeyPregenPoolSatisfactory` Boolean
`KeyProvider` UInt32
`Result` HexInt32

Event ID 5601: Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no pa...

Channel: Operational
Task: ContainerDeletion
Opcode: Informational

Description

Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no password on this device.

Message #

Windows Hello detected and ignored a policy change to delete the container at the user's next sign out because the user is configured to have no password on this device.

Event ID 5602: Windows Hello was unable to check if there was a policy change that would trigger container deletion.

Channel: Operational
Task: ContainerDeletion
Opcode: Informational

Event ID 5641: Windows Hello successfully updated a Key_Name KeyProvider key from the Windows Hello container.

Channel: Operational
Task: KeyUpdate
Opcode: Informational

Message #

Windows Hello successfully updated a %1 %2 key from the Windows Hello container.

Key Name: %3

Fields #

Name	Description
`KeyProvider` UInt32
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString

Event ID 5701: Windows Hello read following protector properties from disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector ...

Channel: Operational
Task: ProtectorDiskIO
Opcode: Informational

Description

Windows Hello read following protector properties from disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector = SecureBioProtector, Preboot protector = RecoveryProtector.

Message #

Windows Hello read following protector properties from disk: PIN protector = %1, Bio protector = %2, Secure Bio Protector = %3, Recovery protector = %4, Preboot protector = %5

Fields #

Name	Description
`Hr` HexInt32
`PinProtector` Boolean
`BioProtector` Boolean
`SecureBioProtector` Boolean
`RecoveryProtector` Boolean
`PrebootProtector` Boolean

Event ID 5702: Windows Hello wrote following protector properties to disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector =...

Channel: Operational
Task: ProtectorDiskIO
Opcode: Informational

Description

Windows Hello wrote following protector properties to disk: PIN protector = Hr, Bio protector = PinProtector, Secure Bio Protector = BioProtector, Recovery protector = SecureBioProtector, Preboot protector = RecoveryProtector.

Message #

Windows Hello wrote following protector properties to disk: PIN protector = %1, Bio protector = %2, Secure Bio Protector = %3, Recovery protector = %4, Preboot protector = %5

Fields #

Name	Description
`Hr` HexInt32
`PinProtector` Boolean
`BioProtector` Boolean
`SecureBioProtector` Boolean
`RecoveryProtector` Boolean
`PrebootProtector` Boolean

Event ID 6010: A key credential was unavailable for use by an application because it did not meet all the requirements for use.

Channel: Operational
Task: KeyUse
Opcode: Informational

Message #

A key credential was unavailable for use by an application because it did not meet all the requirements for use.

Key name: %1
Reason: %2

Fields #

Name	Description
`KeyName` UnicodeString
`KeyUseCredUnavailableReason` UInt32

Event ID 6045: Windows Hello processing stopped with warning Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

Windows Hello processing stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6055: Windows Hello container provisioning stopped with warning Processing_time.

Channel: Operational
Task: ContainerCreation
Opcode: Stop

Message #

Windows Hello container provisioning stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6065: The cloud experience host scenario stopped with warning Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

The cloud experience host scenario stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` UnicodeString
`ProcessingTime` UInt32

Event ID 6066: Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate.

Channel: Operational
Task: CertificateEnrollment
Opcode: Stop

Description

Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate. Automatic certificate enrollment will retry at regular intervals.

Message #

Windows Hello sign-in certificate enrollment was unable to enroll for a logon certificate. Automatic certificate enrollment will retry at regular intervals.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6209: Windows Hello for Business was unable to evaluate the presence of a certificate payload for the sign-in certificate

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 6210: Windows Hello for Business was unable to detect whether the user is running in a remote desktop session

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 6441: Windows Hello for Business certificate trust and cloud trust policies are both enabled.

Channel: Operational
Task: QueryPolicy
Opcode: Informational

Message #

Windows Hello for Business certificate trust and cloud trust policies are both enabled.

Certificate trust policy will be enforced.

Event ID 6520: Provider is not in the acceptable provider list.

Channel: Operational
Task: Multi_FactorUnlock
Opcode: Stop

Event ID 6525: AD/Azure AD plugin request stopped with warning Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

AD/Azure AD plugin request stopped with warning %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 6611: Windows Hello could not delete the container as no container currently exists for the user.

Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Event ID 7001: A user failed to sign into the device with the following information.

Channel: Operational
Opcode: Informational

Message #

A user failed to sign into the device with the following information:

Username: %1
User SID: %2
Credential Type: %3
Deployment Type: %4
Software Lockout Counter: %5
Authentication Error Status: %6
Authentication Error Substatus: %7

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`CredentialType` UInt32	Known values `%%8096` Default credentials `%%8097` Credentials manager `%%8098` Fresh credentials
`DeploymentType` UInt32
`SoftwareLockoutCounter` UInt32
`AuthenticationErrorStatus` HexInt32
`AuthenticationErrorSubStatus` HexInt32

Event ID 7002: Failed to load an existing Windows Hello container.

Channel: Operational
Task: ContainerLoad
Opcode: Informational

Message #

Failed to load an existing Windows Hello container.

ID: %1
Error: %2

Fields #

Name	Description
`ContainerId` GUID
`Error` HexInt32

Event ID 7025: The Error service failed to start.

Channel: Operational
Task: ServiceStart
Opcode: Informational

Message #

The %1 service failed to start.
Error: %2.

Fields #

Name	Description
`ServiceName` UnicodeString
`Error` HexInt32

Event ID 7030: Windows Hello failed to create the sign-in certificate request.

Channel: Operational
Opcode: Informational

Message #

Windows Hello failed to create the sign-in certificate request.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7031: Windows Hello failed to install the sign-in certificate.

Channel: Operational
Opcode: Informational

Message #

Windows Hello failed to install the sign-in certificate.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7032: Windows Hello failed to roll back from an unsuccessful sign-in certificate enrollment.

Channel: Operational
Opcode: Informational

Message #

Windows Hello failed to roll back from an unsuccessful sign-in certificate enrollment.
Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7045: Windows Hello processing failed with Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

Windows Hello processing failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7052: The new key request from the key pre-generation pool failed

Channel: Debug, Operational
Task: KeyCreation
Opcode: Stop

Message #

The new key request from the key pre-generation pool failed.
Error: %1
Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7053: The key pre-generation pool failed to pre-generate a key

Channel: Debug, Operational
Task: KeyCreation
Opcode: Stop

Message #

The key pre-generation pool failed to pre-generate a key.
Error: %1
Processing time: %2 seconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7054: Windows Hello for Business prerequisites check failed.

Channel: Debug
Task: PrerequisitesCheck
Opcode: Stop

Message #

Windows Hello for Business prerequisites check failed.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 7054,
    "level": "Error",
    "task": "Prerequisites Check",
    "opcode": "Stop",
    "time_created": "2026-04-18T01:58:47.6807755+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {
    "Error": "0x1"
  }
}

Event ID 7054: Windows Hello for Business prerequisites check failed.

Channel: Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Stop

Message #

Windows Hello for Business prerequisites check failed.____Error: %1

Fields #

Name	Description
`Error` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7054,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 11,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T16:48:31.714659+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 4128,
      "thread_id": 4228
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "Error": "0x1"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7055: Windows Hello container provisioning failed with Processing_time.

Channel: Operational
Task: ContainerCreation
Opcode: Stop

Message #

Windows Hello container provisioning failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7060: Windows Hello failed to create a PIN recovery key for user Error.

Channel: Operational
Task: PINRecovery
Opcode: Stop

Message #

Windows Hello failed to create a PIN recovery key for user %1.
Error: %2 (%3)
Correlation vector: %4
Processing time: %5 seconds.

Fields #

Name	Description
`UserSid` SID
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7065: The cloud experience host scenario failed with Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

The cloud experience host scenario failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` UnicodeString
`ProcessingTime` UInt32

Event ID 7066: Windows Hello sign-in certificate enrollment failed.

Channel: Operational
Task: CertificateEnrollment
Opcode: Stop

Message #

Windows Hello sign-in certificate enrollment failed.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7067: Windows Hello failed to set a certificate property on a Windows Hello key.

Channel: Operational
Task: CertificateEnrollment
Opcode: Informational

Message #

Windows Hello failed to set a certificate property on a Windows Hello key.

Error: %1
Key name: %2
Certificate type: %3

Fields #

Name	Description
`Error` HexInt32
`KeyName` UnicodeString
`CertificateType` UInt32

Event ID 7130: Windows Hello PIN Recovery failed to change the user's PIN.

Channel: Operational
Task: PINRecovery
Opcode: Stop

Message #

Windows Hello PIN Recovery failed to change the user's PIN.
Error: %1 (%2)
Correlation vector: %3
Processing time: %4 seconds.

Fields #

Name	Description
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7200: The device registration prerequisite check failed

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7201: The Primary Account Primary Refresh Token prerequisite check failed

Channel: Debug, Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7201,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T16:48:31.714659+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 4128,
      "thread_id": 4228
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7202: The device failed to meet the Windows Hello for Business hardware requirements

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7203: Windows Hello for Business is not enabled

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7204: Windows Hello for Business post-logon provisioning is not enabled

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7205: Windows Hello for Business failed to locate a usable sign-in certificate template

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Message #

Windows Hello for Business failed to locate a usable sign-in certificate template.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7206: Windows Hello for Business failed to locate a certificate registration authority

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7207: Windows Hello for Business failed to locate an enterprise management client

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7208: Windows Hello for Business failed to locate a sign-in certificate profile

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7209: Windows Hello for Business failed to locate a certificate payload for the sign-in certificate

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Description

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Message #

Windows Hello for Business failed to locate a certificate payload for the sign-in certificate. The SCEP Request is not available.

Event ID 7210: Windows Hello for Business detected the user running in a remote desktop session.

Channel: Debug
Task: PrerequisitesCheck
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 7210,
    "level": "Error",
    "task": "Prerequisites Check",
    "opcode": "Informational",
    "time_created": "2026-04-18T01:58:47.6807742+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 7210: Windows Hello for Business detected the user running in a remote desktop session.

Channel: Operational
Level: Error
Task: PrerequisitesCheck
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "906B8A99-63CE-58D7-86AB-10989BBD5567",
    "event_source_name": "",
    "event_id": 7210,
    "version": 0,
    "level": 2,
    "task": 12,
    "opcode": 12,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T04:58:41.296416+00:00",
    "event_record_id": 45,
    "correlation": {},
    "execution": {
      "process_id": 3604,
      "thread_id": 7852
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 7211: The Secondary Account Primary Refresh Token prerequisite check failed

Channel: Debug, Operational
Task: PrerequisitesCheck
Opcode: Informational

Event ID 7225: Windows Hello key creation failed with Processing_time.

Channel: Operational
Task: KeyCreation
Opcode: Stop

Message #

Windows Hello key creation failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7226: Windows Hello failed to delete the Key_Name key.

Channel: Operational
Task: KeyDeletion
Opcode: Informational

Message #

Windows Hello failed to delete the %1 key.

Key Name: %2
Error: %3

Fields #

Name	Description
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString
`Error` HexInt32

Event ID 7510: Windows Hello key registration failed.

Channel: Operational
Task: KeyRegistration
Opcode: Stop

Message #

Windows Hello key registration failed.

Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 7520: Failed to authenticate the user's credential.

Channel: Operational
Task: Multi_FactorUnlock
Opcode: Stop

Message #

Failed to authenticate the user's credential.
Error: %1 (%2)
Correlation vector: %3
Processing time: %4 milliseconds.

Fields #

Name	Description
`ErrorText` UnicodeString
`Error` HexInt32
`CorrelationVector` AnsiString
`ProcessingTime` UInt32

Event ID 7525: AD/Azure AD plugin request failed with Processing_time.

Channel: Operational
Task: HelloProvisioning
Opcode: Stop

Message #

AD/Azure AD plugin request failed with %1.
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7555: Windows Hello container creation failed.

Channel: Operational
Task: ContainerCreation
Opcode: Stop

Message #

Windows Hello container creation failed.
Error: %1
Processing time: %2 seconds

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7601: Windows Hello failed to delete the container in response to a policy change.

Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Message #

Windows Hello failed to delete the container in response to a policy change.

Error: %1
Processing time: %2 milliseconds.

Fields #

Name	Description
`Error` HexInt32
`ProcessingTime` UInt32

Event ID 7611: Windows Hello failed to delete the container.

Channel: Operational
Task: ContainerDeletion
Opcode: Stop

Message #

Windows Hello failed to delete the container.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7621: Windows Hello failed to delete the user's Windows Hello certificates.

Channel: Operational
Task: CertificateEnrollment
Opcode: Informational

Message #

Windows Hello failed to delete the user's Windows Hello certificates.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7631: Windows Hello failed to delete the user's biometric enrollments.

Channel: Operational
Task: BiometricEnrollment
Opcode: Informational

Message #

Windows Hello failed to delete the user's biometric enrollments.

Error: %1.

Fields #

Name	Description
`Error` HexInt32

Event ID 7701: Windows Hello failed to use secure biometrics protector due to secret encryption key loss.

Channel: Operational
Task: ProtectorUse
Opcode: Informational

Event ID 7703: Windows Hello operation failed because the Windows Hello for Business policy is set to disabled.

Channel: Operational
Task: PolicyEnforcement
Opcode: Stop

Event ID 8002: Successfully loaded an existing KeyProvider Windows Hello container.

Channel: Operational
Task: Container Load
Opcode: Informational

Message #

Successfully loaded an existing %3 Windows Hello container.

ID: %1
Version: %2
Has Cached Logon Key: %4
State: %5

Fields #

Name	Description
`ContainerId` GUID
`ContainerVersion` UInt32
`KeyProvider` UInt32
`HasCachedLogonKey` Boolean
`ContainerStatus` UInt32

Event ID 8025: The ServiceName service started successfully.

Channel: Operational
Level: Success
Task: Service Start
Opcode: Informational

Message #

The %1 service started successfully.

Fields #

Name	Description
`ServiceName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8025,
    "version": 0,
    "level": 16,
    "task": 6,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-28T12:08:16.4045809+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 6132,
      "thread_id": 5148
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ServiceName": "Microsoft Passport Container"
  },
  "message": "The Microsoft Passport Container service started successfully."
}

Event ID 8030: Windows Hello created the sign-in certificate request successfully.

Channel: Operational
Opcode: Informational

Event ID 8031: Windows Hello installed the sign-in certificate successfully.

Channel: Operational
Opcode: Informational

Event ID 8032: Windows Hello successfully rolled back from an unsuccessful sign-in certificate enrollment.

Channel: Operational
Opcode: Informational

Event ID 8045: Windows Hello processing completed successfully.

Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Message #

Windows Hello processing completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8052: The new key request from the key pre-generation pool completed successfully

Channel: Debug, Operational
Task: Key Creation
Opcode: Stop

Message #

The new key request from the key pre-generation pool completed successfully.
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8053: The key pre-generation pool successfully pre-generated a key

Channel: Debug, Operational
Task: Key Creation
Opcode: Stop

Message #

The key pre-generation pool successfully pre-generated a key. 
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8054: Windows Hello for Business prerequisites check completed successfully.

Channel: Debug
Task: Prerequisites Check
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 8054,
    "level": "Success",
    "task": "Prerequisites Check",
    "opcode": "Stop",
    "time_created": "2026-04-23T15:41:39.4152865+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 8054: Windows Hello for Business prerequisites check completed successfully.

Channel: Operational
Level: Success
Task: Prerequisites Check
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8054,
    "version": 0,
    "level": 16,
    "task": 12,
    "opcode": 11,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598987+00:00",
    "event_record_id": 69,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business prerequisites check completed successfully."
}

Event ID 8055: Windows Hello container provisioning completed successfully.

Channel: Operational
Task: Container Creation
Opcode: Stop

Message #

Windows Hello container provisioning completed successfully.
Processing time: %1 seconds
Existing container: %2

Fields #

Name	Description
`ProcessingTime` UInt32
`UsedExistingContainer` Boolean

Event ID 8060: Windows Hello successfully created a PIN recovery key for user Processing_time.

Channel: Operational
Task: PIN Recovery
Opcode: Stop

Message #

Windows Hello successfully created a PIN recovery key for user %1.
Processing time: %2 seconds

Fields #

Name	Description
`UserSid` SID
`ProcessingTime` UInt32

Event ID 8065: The cloud experience host completed successfully.

Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Message #

The cloud experience host completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8066: Windows Hello sign-in certificate enrollment completed successfully.

Channel: Operational
Task: Certificate Enrollment
Opcode: Stop

Message #

Windows Hello sign-in certificate enrollment completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8067: Windows Hello set a certificate property on a Windows Hello key.

Channel: Operational
Task: Certificate Enrollment
Opcode: Informational

Message #

Windows Hello set a certificate property on a Windows Hello key.

Key name: %1
Certificate type: %2

Fields #

Name	Description
`KeyName` UnicodeString
`CertificateType` UInt32

Event ID 8130: Windows Hello PIN Recovery successfully changed the user's PIN.

Channel: Operational
Task: PIN Recovery
Opcode: Stop

Message #

Windows Hello PIN Recovery successfully changed the user's PIN.
Processing time: %1 seconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8200: The device registration prerequisite check completed successfully

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8201: The Primary Account Primary Refresh Token prerequisite check completed successfully

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8202: The device meets Windows Hello for Business hardware requirements

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8203: Windows Hello for Business is enabled

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8204: Windows Hello for Business post-logon provisioning is enabled

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8205: Windows Hello for Business successfully located a usable sign-on certificate template

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8206: Windows Hello for Business successfully located a certificate registration authority

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8207: Windows Hello for Business successfully located an enterprise management client

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8208: Windows Hello for Business successfully located a sign-in certificate profile

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8209: Windows Hello for Business successfully located a certificate payload for the sign-in certificate

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Description

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Message #

Windows Hello for Business successfully located a certificate payload for the sign-in certificate. The SCEP Request is available.

Event ID 8210: Windows Hello for Business successfully completed the remote desktop prerequisite check.

Channel: Debug
Task: Prerequisites Check
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "event_id": 8210,
    "level": "Success",
    "task": "Prerequisites Check",
    "opcode": "Informational",
    "time_created": "2026-04-23T15:41:39.4152745+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-HelloForBusiness/Operational"
  },
  "event_data": {}
}

Event ID 8210: Windows Hello for Business successfully completed the remote desktop prerequisite check.

Channel: Operational
Level: Success
Task: Prerequisites Check
Opcode: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HelloForBusiness",
    "guid": "{906B8A99-63CE-58D7-86AB-10989BBD5567}",
    "event_source_name": "",
    "event_id": 8210,
    "version": 0,
    "level": 16,
    "task": 12,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T16:34:07.4598896+00:00",
    "event_record_id": 68,
    "correlation": {},
    "execution": {
      "process_id": 6328,
      "thread_id": 6432
    },
    "channel": "Microsoft-Windows-HelloForBusiness/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Windows Hello for Business successfully completed the remote desktop prerequisite check."
}

Event ID 8211: The Secondary Account Primary Refresh Token prerequisite check completed successfully

Channel: Debug, Operational
Task: Prerequisites Check
Opcode: Informational

Event ID 8225: Windows Hello key creation completed successfully.

Channel: Operational
Task: Key Creation
Opcode: Stop

Message #

Windows Hello key creation completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8226: Windows Hello successfully deleted a Key_Name KeyProvider key from the Windows Hello container.

Channel: Operational
Task: Key Deletion
Opcode: Informational

Message #

Windows Hello successfully deleted a %1 %2 key from the Windows Hello container.

Key Name: %3

Fields #

Name	Description
`KeyProvider` UInt32
`KeyType` UInt32	Known values `%%2499` Machine key `%%2500` User key
`KeyName` UnicodeString

Event ID 8510: Windows Hello key registration completed successfully.

Channel: Operational
Task: Key Registration
Opcode: Stop

Event ID 8520: Successfully authenticated the user's credential.

Channel: Operational
Task: Multi-Factor Unlock
Opcode: Stop

Message #

Successfully authenticated the user's credential.
Processing time: %1 milliseconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8525: AD/Azure AD plugin request completed successfully.

Channel: Operational
Task: Hello Provisioning
Opcode: Stop

Message #

AD/Azure AD plugin request completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8555: The Windows Hello container creation completed successfully.

Channel: Operational
Task: Container Creation
Opcode: Stop

Message #

The Windows Hello container creation completed successfully.
Processing time: %1 seconds

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8601: Windows Hello successfully deleted the container in response to a policy change.

Channel: Operational
Task: Container Deletion
Opcode: Stop

Message #

Windows Hello successfully deleted the container in response to a policy change.

Processing time: %1 milliseconds.

Fields #

Name	Description
`ProcessingTime` UInt32

Event ID 8611: Windows Hello successfully deleted the container.

Channel: Operational
Task: Container Deletion
Opcode: Stop

Event ID 8621: Windows Hello successfully deleted the user's Windows Hello certificates.

Channel: Operational
Task: Certificate Enrollment
Opcode: Informational

Event ID 8631: Windows Hello successfully deleted the user's biometric enrollments.

Channel: Operational
Task: BiometricEnrollment
Opcode: Informational

Event ID 8632: Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Message #

Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information: 

Username: %1
User SID: %2
Domain: %3
User-Entered: %4

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`Domain` UnicodeString	[Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information] Domain.
`UserEntered` Boolean	[Windows Hello for Business successfully added a user entry to the Username/SID cache with the following information] User-Entered.

Event ID 8633: Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information: User SID.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information.

Message #

Windows Hello for Business successfully removed a user entry to the Username/SID cache with the following information: 

User SID: %1

Fields #

Name	Description
`UserSid` SID

Event ID 8634: Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache: User S...

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache.

Message #

Windows Hello for Business found a user entry with a duplicate SID and successfully removed the unused username from the Username/SID cache: 

User SID: %1
Username: %2
Unused Username: %3

Fields #

Name	Description
`UserSid` SID
`UserName` UnicodeString
`UnusedUserName` UnicodeString

Event ID 8635: Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache: Userna...

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache.

Message #

Windows Hello for Business found a user entry with a duplicate username and successfully removed the unused SID from the Username/SID cache: 

Username: %1
User SID: %2
Unused User SID: %3

Fields #

Name	Description
`UserName` UnicodeString
`UserSid` SID
`UnusedUserSid` SID

Event ID 8636: Windows Hello for Business found a stale SID in the Username/SID cache.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Message #

Windows Hello for Business found a stale SID in the Username/SID cache: 

Username: %1
User SID: %2
Stale User SID: %3

Fields #

Name	Description
`UserName` UnicodeString
`CurrentlyMostRecentUserSid` SID
`StaleUserSid` SID

Event ID 8637: Windows Hello for Business found a stale username in the Username/SID cache.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Message #

Windows Hello for Business found a stale username in the Username/SID cache: 

User SID: %1
Username: %2
Stale Username: %3

Fields #

Name	Description
`UserSid` SID
`CurrentlyMostRecentUserName` UnicodeString
`StaleUserName` UnicodeString

Event ID 8638: Windows Hello for Business removed a stale SID from the Username/SID cache: Stale User SID.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Description

Windows Hello for Business removed a stale SID from the Username/SID cache.

Message #

Windows Hello for Business removed a stale SID from the Username/SID cache: 

Stale User SID: %1

Fields #

Name	Description
`StaleUserSid` SID

Event ID 8639: Windows Hello for Business removed a stale username from the Username/SID cache.

Channel: Operational
Task: Windows Hello Username/SID Cache
Opcode: Informational

Message #

Windows Hello for Business removed a stale username from the Username/SID cache: 

User SID: %1
Stale Username: %2

Fields #

Name	Description
`UserSid` SID
`StaleUserName` UnicodeString

Event ID 8640: Windows Hello for Business PIN was changed by a user with the following information: User SID.

Channel: Operational
Task: PIN Change
Opcode: Informational

Description

Windows Hello for Business PIN was changed by a user with the following information.

Message #

Windows Hello for Business PIN was changed by a user with the following information: 
User SID: %1

Fields #

Name	Description
`UserSid` SID

Provenance

ETW provider GUID 906b8a99-63ce-58d7-86ab-10989bbd5567

Defined in cryptngc.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB