Microsoft-Windows-LiveId

Event	Title	Channel	Sample	Rule
1002	LsaApLogonUserEx2_Stop.	Analytic	N	N
1004	SpOnProfileLoaded_Stop.	Analytic	N	N
1005	ConnectIdentity_Start	Analytic	N	N
1006	ConnectIdentity_Stop.	Analytic	N	N
1007	DisconnectIdentity_Start	Analytic	N	N
1008	DisconnectIdentity_Stop.	Analytic	N	N
1010	LiveDoCachedLogon_Stop.	Analytic	N	N
1012	LiveAuthenticate_Stop.	Analytic	N	N
1013	NetworkCall_Start	Analytic	N	N
1014	NetworkCall_Stop.	Analytic	N	N
1015	DeviceAuth_Start	Analytic	Y	N
1016	DeviceAuth_Stop.	Analytic	Y	N
1017	UserAuth_Start	Analytic	N	N
1018	UserAuth_Stop.	Analytic	N	N
1019	PromptForCredentials_Start	Analytic	N	N
1020	PromptForCredentials_Stop.	Analytic	N	N
1021	SignOutUser_RegistryOpenOrReadFailure.	Operational	N	N
1022	SignOutUser_RegistryWriteFailure.	Operational	N	N
2008	DeviceAuthAsync_Start	Analytic	Y	N
2009	DeviceAuthAsync_Stop	Analytic	Y	N
2010	UserAuthAsync_Start	Analytic	N	N
2011	UserAuthAsync_Stop	Analytic	N	N
2012	SignOutUser_Start	Analytic	N	N
2013	SignOutUser_Stop	Analytic	N	N
2014	WLIDSvcReady	Analytic	N	N
2015	CommandLinkClicked_Start	Analytic	N	N
2016	CommandLinkClicked_Stop.	Analytic	N	N
2017	UserImageGetBitmapValue_Start	Analytic	N	N
2018	UserImageGetBitmapValue_Stop.	Analytic	N	N
2019	CredProvSetSerialization_Start	Analytic	N	N
2020	CredProvSetSerialization_Stop.	Analytic	N	N
2021	CredProvGetSerialization_Start	Analytic	N	N
2022	CredProvGetSerialization_Stop.	Analytic	N	N
2023	Operation: Operation.	Operational	N	N
2024	Operation: Operation.	Operational	Y	N
2025	WLIDSvc service failed to start.	Operational	N	N
2026	Generic telemetry trigger event.	Analytic	N	N
2027	User specific telemetry trigger event for CID cid.	Analytic	N	N
2028	ErrorVerifier in function FunctionName encountered unexpected error code …	Operational	Y	N
2029	Assertion failure for expression ({Expression}) in function {FunctionName} …	Operational	N	N
3000	description @FileName_LineNumber.	Operational	N	N
3001	description @FileName_LineNumber.	Operational	N	N
3002	description @FileName_LineNumber.	Operational	N	N
3003	description @FileName_LineNumber.	Operational	N	N
3004	description @FileName_LineNumber.	Operational	N	N
3005	description @FileName_LineNumber.	Operational	N	N
3006	description @FileName_LineNumber.	Operational	N	N
3007	description @FileName_LineNumber.	Operational	N	N
3008	+.	Operational	N	N
3009	-.	Operational	N	N
3010	-.	Operational	N	N
3011	-.	Operational	N	N
3012	Process name ProcessName.	Operational	N	N
3013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
3014	-.	Operational	N	N
3015	description @FileName_LineNumber.	Operational	N	N
3016	description @FileName_LineNumber.	Operational	N	N
4000	description @FileName_LineNumber.	Operational	N	N
4001	description @FileName_LineNumber.	Operational	N	N
4002	description @FileName_LineNumber.	Operational	N	N
4003	description @FileName_LineNumber.	Operational	N	N
4004	description @FileName_LineNumber.	Operational	N	N
4005	description @FileName_LineNumber.	Operational	N	N
4006	description @FileName_LineNumber.	Operational	N	N
4007	description @FileName_LineNumber.	Operational	N	N
4008	+.	Operational	N	N
4009	-.	Operational	N	N
4010	-.	Operational	N	N
4011	-.	Operational	N	N
4012	Process name ProcessName.	Operational	N	N
4013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
4014	-.	Operational	N	N
4015	description @FileName_LineNumber.	Operational	N	N
4016	description @FileName_LineNumber.	Operational	N	N
5000	description @FileName_LineNumber.	Operational	N	N
5001	description @FileName_LineNumber.	Operational	N	N
5002	description @FileName_LineNumber.	Operational	N	N
5003	description @FileName_LineNumber.	Operational	N	N
5004	description @FileName_LineNumber.	Operational	N	N
5005	description @FileName_LineNumber.	Operational	N	N
5006	description @FileName_LineNumber.	Operational	N	N
5007	description @FileName_LineNumber.	Operational	N	N
5008	+.	Operational	N	N
5009	-.	Operational	N	N
5010	-.	Operational	N	N
5011	-.	Operational	N	N
5012	Process name ProcessName.	Operational	N	N
5013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
5014	-.	Operational	N	N
5015	description @FileName_LineNumber.	Operational	N	N
5016	description @FileName_LineNumber.	Operational	N	N
6000	description @FileName_LineNumber.	Operational	N	N
6001	description @FileName_LineNumber.	Operational	N	N
6002	description @FileName_LineNumber.	Operational	N	N
6003	description @FileName_LineNumber.	Operational	N	N
6004	description @FileName_LineNumber.	Operational	N	N
6005	description @FileName_LineNumber.	Operational	N	N
6006	description @FileName_LineNumber.	Operational	N	N
6007	description @FileName_LineNumber.	Operational	N	N
6008	+.	Operational	N	N
6009	-.	Operational	N	N
6010	-.	Operational	N	N
6011	-.	Operational	N	N
6012	Process name ProcessName.	Operational	N	N
6013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
6014	-.	Operational	N	N
6015	description @FileName_LineNumber.	Operational	N	N
6016	description @FileName_LineNumber.	Operational	N	N
6100	Service Create Context for [value].	Operational	N	N
6101	Token with target [TargetName] expired on ExpiryTime, Deleting it from CredMan.	Operational	N	N
6102	Certificate (target = [value]) has expired.	Operational	N	N
6103	RemoveCachedAuthInfo Deleting item for target [value] from CredMan.	Operational	N	N
6104	RemoveCachedAuthInfo ALL Deleting [value] items from CredMan.	Operational	N	N
6105	RemovePersistedTokens Deleting item for target [value] from CredMan.	Operational	N	N
6106	Attempting to delete for target [.	Operational	N	N
6107	Write to CredMan failed for target [.	Operational	N	N
6108	Writing Token for target [.	Operational	N	N
6109	CredEnumerateW failed for target [.	Operational	N	N
6110	CredEnumerateW found no match for target [.	Operational	N	N
6111	DeleteStoredCredential Deleting item for target [.	Operational	N	N
6112	CredMan activity skipped.	Operational	N	N
6113	RPC call to function FunctionName returned the following error code: ErrorCode.	Operational	Y	N
6114	SOAP Request of type RequestType for user CID 'cid' in MachineEnvironment …	Operational	Y	N
6115	## SOAP Request: Value.	Operational	Y	N
6116	## SOAP Response: Value.	Operational	Y	N
6117	Acquired Service token.	Operational	Y	N
7000	description @FileName_LineNumber.	Operational	N	N
7001	description @FileName_LineNumber.	Operational	Y	N
7002	description @FileName_LineNumber.	Operational	N	N
7003	description @FileName_LineNumber.	Operational	Y	N
7004	description @FileName_LineNumber.	Operational	N	N
7005	description @FileName_LineNumber.	Operational	N	N
7006	description @FileName_LineNumber.	Operational	N	N
7007	description @FileName_LineNumber.	Operational	N	N
7008	+.	Operational	Y	N
7009	-.	Operational	Y	N
7010	-.	Operational	N	N
7011	-.	Operational	N	N
7012	Process name ProcessName.	Operational	N	N
7013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
7014	-.	Operational	N	N
7015	description @FileName_LineNumber.	Operational	Y	N
7016	description @FileName_LineNumber.	Operational	N	N
7100	Cached ticket for site Uri and policy Policy found which is valid for another …	Operational	Y	N
7101	ApplicationId Overwritten [value1] becomes [value2].	Operational	N	N
7102	ApplicationId [value].	Operational	Y	N
7103	Cached ticket for site value1 and policy value2 not found or has expired.	Operational	N	N
7104	Attempts = [Attempts], latestIterationResult = [latestIterationResult], …	Operational	N	N
7105	WLIDCPersistCredential [value].	Operational	N	N
8000	description @FileName_LineNumber.	Operational	N	N
8001	description @FileName_LineNumber.	Operational	N	N
8002	description @FileName_LineNumber.	Operational	N	N
8003	description @FileName_LineNumber.	Operational	N	N
8004	description @FileName_LineNumber.	Operational	N	N
8005	description @FileName_LineNumber.	Operational	N	N
8006	description @FileName_LineNumber.	Operational	N	N
8007	description @FileName_LineNumber.	Operational	N	N
8008	+.	Operational	N	N
8009	-.	Operational	N	N
8010	-.	Operational	N	N
8011	-.	Operational	N	N
8012	Process name ProcessName.	Operational	N	N
8013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
8014	-.	Operational	N	N
8015	description @FileName_LineNumber.	Operational	N	N
8016	description @FileName_LineNumber.	Operational	N	N
9000	description @FileName_LineNumber.	Operational	N	N
9001	description @FileName_LineNumber.	Operational	N	N
9002	description @FileName_LineNumber.	Operational	Y	N
9003	description @FileName_LineNumber.	Operational	N	N
9004	description @FileName_LineNumber.	Operational	N	N
9005	description @FileName_LineNumber.	Operational	N	N
9006	description @FileName_LineNumber.	Operational	N	N
9007	description @FileName_LineNumber.	Operational	N	N
9008	+.	Operational	Y	N
9009	-.	Operational	Y	N
9010	-.	Operational	N	N
9011	-.	Operational	N	N
9012	Process name ProcessName.	Operational	Y	N
9013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
9014	-.	Operational	Y	N
9015	description @FileName_LineNumber.	Operational	Y	N
9016	description @FileName_LineNumber.	Operational	N	N
9100	WLIDCPersistCredential [value].	Operational	N	N
10000	description @FileName_LineNumber.	Operational	N	N
10001	description @FileName_LineNumber.	Operational	N	N
10002	description @FileName_LineNumber.	Operational	N	N
10003	description @FileName_LineNumber.	Operational	N	N
10004	description @FileName_LineNumber.	Operational	N	N
10005	description @FileName_LineNumber.	Operational	N	N
10006	description @FileName_LineNumber.	Operational	N	N
10007	description @FileName_LineNumber.	Operational	N	N
10008	+.	Operational	N	N
10009	-.	Operational	N	N
10010	-.	Operational	N	N
10011	-.	Operational	N	N
10012	Process name ProcessName.	Operational	N	N
10013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
10014	-.	Operational	N	N
10015	description @FileName_LineNumber.	Operational	N	N
10016	description @FileName_LineNumber.	Operational	N	N
11000	description @FileName_LineNumber.	Operational	N	N
11001	description @FileName_LineNumber.	Operational	N	N
11002	description @FileName_LineNumber.	Operational	N	N
11003	description @FileName_LineNumber.	Operational	N	N
11004	description @FileName_LineNumber.	Operational	N	N
11005	description @FileName_LineNumber.	Operational	N	N
11006	description @FileName_LineNumber.	Operational	N	N
11007	description @FileName_LineNumber.	Operational	N	N
11008	+.	Operational	N	N
11009	-.	Operational	N	N
11010	-.	Operational	N	N
11011	-.	Operational	N	N
11012	Process name ProcessName.	Operational	N	N
11013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
11014	-.	Operational	N	N
11015	description @FileName_LineNumber.	Operational	N	N
11016	description @FileName_LineNumber.	Operational	N	N
12000	description @FileName_LineNumber.	Operational	N	N
12001	description @FileName_LineNumber.	Operational	N	N
12002	description @FileName_LineNumber.	Operational	N	N
12003	description @FileName_LineNumber.	Operational	N	N
12004	description @FileName_LineNumber.	Operational	N	N
12005	description @FileName_LineNumber.	Operational	N	N
12006	description @FileName_LineNumber.	Operational	N	N
12007	description @FileName_LineNumber.	Operational	N	N
12008	+.	Operational	N	N
12009	-.	Operational	N	N
12010	-.	Operational	N	N
12011	-.	Operational	N	N
12012	Process name ProcessName.	Operational	N	N
12013	IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName …	Operational	N	N
12014	-.	Operational	N	N
12015	description @FileName_LineNumber.	Operational	N	N
12016	description @FileName_LineNumber.	Operational	N	N

Event ID 1002: LsaApLogonUserEx2_Stop.

Channel: Analytic

Description

LsaApLogonUserEx2_Stop.Status: {Status}.

Message #

LsaApLogonUserEx2_Stop.Status: {Status}

Fields #

Name	Description
`Status`	NTSTATUS reference

Event ID 1004: SpOnProfileLoaded_Stop.

Channel: Analytic

Description

SpOnProfileLoaded_Stop.ServiceCalled: {ServiceCalled} Status: {Status}.

Message #

SpOnProfileLoaded_Stop.ServiceCalled: {ServiceCalled}	Status: {Status}

Fields #

Name	Description
`ServiceCalled`
`Status`	NTSTATUS reference

Event ID 1005: ConnectIdentity_Start

Channel: Analytic
Task: IdentityProviderOperation
Opcode: Start

Event ID 1006: ConnectIdentity_Stop.

Channel: Analytic
Task: IdentityProviderOperation
Opcode: Stop

Message #

ConnectIdentity_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 1007: DisconnectIdentity_Start

Channel: Analytic
Task: IdentityProviderOperation
Opcode: Start

Event ID 1008: DisconnectIdentity_Stop.

Channel: Analytic
Task: IdentityProviderOperation
Opcode: Stop

Message #

DisconnectIdentity_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 1010: LiveDoCachedLogon_Stop.

Channel: Analytic

Description

LiveDoCachedLogon_Stop.Status: {Result}.

Message #

LiveDoCachedLogon_Stop.Status: {Result}

Fields #

Name	Description
`Result`

Event ID 1012: LiveAuthenticate_Stop.

Channel: Analytic

Description

LiveAuthenticate_Stop.Status: {Status}.

Message #

LiveAuthenticate_Stop.Status: {Status}

Fields #

Name	Description
`Status`	NTSTATUS reference

Event ID 1013: NetworkCall_Start

Channel: Analytic
Task: WLIDServiceOperation
Opcode: Start

Event ID 1014: NetworkCall_Stop.

Channel: Analytic
Task: WLIDServiceOperation
Opcode: Stop

Message #

NetworkCall_Stop.
Number of Targets: %1
RequestType: %2

Fields #

Name	Description
`NoOfTargets` UInt32
`RequestType` UInt32

Event ID 1015: DeviceAuth_Start

Channel: Analytic
Level: Informational
Task: LiveIdModernAPIOperation
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1015,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.162Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 1016: DeviceAuth_Stop.

Channel: Analytic
Level: Informational
Task: LiveIdModernAPIOperation
Opcode: Stop

Message #

DeviceAuth_Stop.
Status: %1

Fields #

Name	Description
`TicketsCached` Boolean
`Result` HexInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1016,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.168Z",
    "version": 0
  },
  "event_data": {
    "Result": "00000000",
    "TicketsCached": true
  },
  "message": ""
}

Event ID 1017: UserAuth_Start

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Start

Event ID 1018: UserAuth_Stop.

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Stop

Message #

UserAuth_Stop.
Status: %1

Fields #

Name	Description
`TicketsCached` Boolean
`Result` HexInt32

Event ID 1019: PromptForCredentials_Start

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Start

Event ID 1020: PromptForCredentials_Stop.

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Stop

Message #

PromptForCredentials_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 1021: SignOutUser_RegistryOpenOrReadFailure.

Channel: Operational
Task: LiveIdModernAPIOperation

Message #

SignOutUser_RegistryOpenOrReadFailure. 
RegistryLocation: %1. 
Status: %2

Fields #

Name	Description
`RegistryLocation` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1022: SignOutUser_RegistryWriteFailure.

Channel: Operational
Task: LiveIdModernAPIOperation

Message #

SignOutUser_RegistryWriteFailure. 
RegistryLocation: %1. 
Status: %2

Fields #

Name	Description
`RegistryLocation` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 2008: DeviceAuthAsync_Start

Channel: Analytic
Level: Informational
Task: LiveIdModernAPIOperation
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2008,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.162Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2009: DeviceAuthAsync_Stop

Channel: Analytic
Level: Informational
Task: LiveIdModernAPIOperation
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2009,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.168Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2010: UserAuthAsync_Start

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Start

Event ID 2011: UserAuthAsync_Stop

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Stop

Event ID 2012: SignOutUser_Start

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Start

Event ID 2013: SignOutUser_Stop

Channel: Analytic
Task: LiveIdModernAPIOperation
Opcode: Stop

Event ID 2014: WLIDSvcReady

Channel: Analytic
Task: WLIDServiceOperation
Opcode: Start

Event ID 2015: CommandLinkClicked_Start

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Start

Event ID 2016: CommandLinkClicked_Stop.

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Stop

Message #

CommandLinkClicked_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 2017: UserImageGetBitmapValue_Start

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Start

Event ID 2018: UserImageGetBitmapValue_Stop.

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Stop

Message #

UserImageGetBitmapValue_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 2019: CredProvSetSerialization_Start

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Start

Event ID 2020: CredProvSetSerialization_Stop.

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Stop

Message #

CredProvSetSerialization_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 2021: CredProvGetSerialization_Start

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Start

Event ID 2022: CredProvGetSerialization_Stop.

Channel: Analytic
Task: WLIDCredProvOperation
Opcode: Stop

Message #

CredProvGetSerialization_Stop.
Status: %1

Fields #

Name	Description
`Result` Int32

Event ID 2023: Operation: Operation.

Channel: Operational
Task: WLIDServiceOperation

Message #

Operation: %1
Details: %2
Status: %3

Fields #

Name	Description
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Target` UnicodeString
`Result` HexInt32

Event ID 2024: Operation: Operation.

Channel: Operational
Level: Informational
Task: WLIDServiceOperation

Message #

Operation: %1
Details: %2
Status: %3

Fields #

Name	Description
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Details` UnicodeString
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 2024,
    "version": 0,
    "level": 4,
    "task": 101,
    "opcode": 0,
    "keywords": 4611686018427387920,
    "time_created": "2026-06-13T05:46:27.8384879+00:00",
    "event_record_id": 358,
    "correlation": {},
    "execution": {
      "process_id": 5900,
      "thread_id": 5832
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Operation": "Service stopped",
    "Details": "The service has stopped.",
    "Status": "0x0"
  },
  "message": "Operation: Service stopped\r\nDetails: The service has stopped.\r\nStatus: 0x0\r\n"
}

Event ID 2025: WLIDSvc service failed to start.

Channel: Operational
Task: WLIDServiceOperation

Message #

WLIDSvc service failed to start.
Function: %1
Reason: %2
Status: %3

Fields #

Name	Description
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Reason` UnicodeString
`Result` HexInt32

Event ID 2026: Generic telemetry trigger event.

Channel: Analytic
Opcode: Info

Message #

Generic telemetry trigger event.
PointType: %1
AppName: %2
ModuleName: %3
ModuleVersion: %4
FileName: %5
FunctionName: %6
LineNumber: %7
ErrorCode: %8

Fields #

Name	Description
`PointType` UnicodeString
`AppName` UnicodeString
`ModuleName` UnicodeString
`ModuleVersion` UnicodeString
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`ErrorCode` Int32

Event ID 2027: User specific telemetry trigger event for CID cid.

Channel: Analytic
Opcode: Info

Message #

User specific telemetry trigger event for CID %1.

Fields #

Name	Description
`cid` UnicodeString

Event ID 2028: ErrorVerifier in function FunctionName encountered unexpected error code (ErrorCode).

Channel: Operational
Level: Error
Opcode: Info

Message #

ErrorVerifier in function %1 encountered unexpected error code (%2).

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 2028,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387907,
    "time_created": "2026-05-27T14:22:01.4477439+00:00",
    "event_record_id": 279,
    "correlation": {
      "ActivityID": "{03E78711-EDE2-0006-568F-E703E2EDDC01}"
    },
    "execution": {
      "process_id": 5208,
      "thread_id": 1188
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "FunctionName": "Windows::Internal::Security::WebAuthentication::UserHostAuthenticationOperation::RetrieveDeviceData",
    "ErrorCode": "-2147023584"
  },
  "message": "ErrorVerifier in function Windows::Internal::Security::WebAuthentication::UserHostAuthenticationOperation::RetrieveDeviceData encountered unexpected error code (A specified logon session does not exist. It may already have been terminated.)."
}

Event ID 2029: Assertion failure for expression ({Expression}) in function {FunctionName} @{FileName}_{LineNumber}.

Channel: Operational

Fields #

Name	Description
`Expression`
`FunctionName`
`FileName`
`LineNumber`

Event ID 3000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 3005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 3006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 3007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 3008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 3010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 3011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 3012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 3013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 3014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 3015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 3016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 4000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 4005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 4006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 4007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 4008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 4010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 4011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 4012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 4013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 4014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 4015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 4016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 5000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 5005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 5006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 5007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 5008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 5010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 5011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 5012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 5013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 5014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 5015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 5016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6008: +.

Channel: Operational
Task: FunctionCall
Opcode: Start

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6009: -.

Channel: Operational
Task: FunctionCall
Opcode: Stop

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 6010: -.

Channel: Operational
Task: FunctionCall
Opcode: Stop

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 6011: -.

Channel: Operational
Task: FunctionCall
Opcode: Stop

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 6012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 6013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 6014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 6015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 6016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 6100: Service Create Context for [value].

Channel: Operational
Opcode: Info

Message #

Service Create Context for [%1]

Fields #

Name	Description
`value` UnicodeString

Event ID 6101: Token with target [TargetName] expired on ExpiryTime, Deleting it from CredMan.

Channel: Operational
Opcode: Info

Message #

Token with target [%1] expired on %2, Deleting it from CredMan.

Fields #

Name	Description
`TargetName` UnicodeString
`ExpiryTime` FILETIME

Event ID 6102: Certificate (target = [value]) has expired.

Channel: Operational
Opcode: Info

Description

Certificate (target = [value]) has expired. Deleting from CredMan.

Message #

Certificate (target = [%1]) has expired. Deleting from CredMan.

Fields #

Name	Description
`value` UnicodeString

Event ID 6103: RemoveCachedAuthInfo Deleting item for target [value] from CredMan.

Channel: Operational
Opcode: Info

Message #

RemoveCachedAuthInfo Deleting item for target [%1] from CredMan.

Fields #

Name	Description
`value` UnicodeString

Event ID 6104: RemoveCachedAuthInfo ALL Deleting [value] items from CredMan.

Channel: Operational
Opcode: Info

Message #

RemoveCachedAuthInfo ALL Deleting [%1] items from CredMan.

Fields #

Name	Description
`value` Int32

Event ID 6105: RemovePersistedTokens Deleting item for target [value] from CredMan.

Channel: Operational
Opcode: Info

Message #

RemovePersistedTokens Deleting item for target [%1] from CredMan.

Fields #

Name	Description
`value` Int32

Event ID 6106: Attempting to delete for target [.

Channel: Operational

Description

Attempting to delete for target [{TargetName}] from CredMan failed with {ErrorCode}.

Message #

Attempting to delete for target [{TargetName}] from CredMan failed with {ErrorCode}.

Fields #

Name	Description
`TargetName`
`ErrorCode`

Event ID 6107: Write to CredMan failed for target [.

Channel: Operational

Description

Write to CredMan failed for target [{TargetName}] with {ErrorCode}.

Message #

Write to CredMan failed for target [{TargetName}] with {ErrorCode}.

Fields #

Name	Description
`TargetName`
`ErrorCode`

Event ID 6108: Writing Token for target [.

Channel: Operational

Description

Writing Token for target [{value}] to CredMan.

Message #

Writing Token for target [{value}] to CredMan.

Fields #

Name	Description
`value`

Event ID 6109: CredEnumerateW failed for target [.

Channel: Operational

Description

CredEnumerateW failed for target [{TargetName}] with {ErrorCode}.

Message #

CredEnumerateW failed for target [{TargetName}] with {ErrorCode}.

Fields #

Name	Description
`TargetName`
`ErrorCode`

Event ID 6110: CredEnumerateW found no match for target [.

Channel: Operational

Description

CredEnumerateW found no match for target [{value}].

Message #

CredEnumerateW found no match for target [{value}].

Fields #

Name	Description
`value`

Event ID 6111: DeleteStoredCredential Deleting item for target [.

Channel: Operational

Description

DeleteStoredCredential Deleting item for target [{value}] from CredMan.

Message #

DeleteStoredCredential Deleting item for target [{value}] from CredMan.

Fields #

Name	Description
`value`

Event ID 6112: CredMan activity skipped.

Channel: Operational
Opcode: Info

Description

CredMan activity skipped. Credential not changed for [WindowsLive:(token):name=value1;serviceuri=value2.

Message #

CredMan activity skipped. Credential not changed for [WindowsLive:(token):name=%1;serviceuri=%2

Fields #

Name	Description
`value1` UnicodeString
`value2` AnsiString

Event ID 6113: RPC call to function FunctionName returned the following error code: ErrorCode.

Channel: Operational
Level: Error
Opcode: Info

Message #

RPC call to function %1 returned the following error code: %2.

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` UInt32	1 returned the following error code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 6113,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018431584274,
    "time_created": "2026-05-27T14:22:01.4475966+00:00",
    "event_record_id": 277,
    "correlation": {},
    "execution": {
      "process_id": 2252,
      "thread_id": 6112
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FunctionName": "WLIDCreateContext",
    "ErrorCode": "2147943712"
  },
  "message": "RPC call to function WLIDCreateContext returned the following error code: 0x80070520."
}

Event ID 6114: SOAP Request of type RequestType for user CID 'cid' in MachineEnvironment environment received the following error code from the Microsoft Account server: ErrorCode.

Channel: Operational
Level: Error
Opcode: Info

Message #

SOAP Request of type %1 for user CID '%2' in %4 environment received the following error code from the Microsoft Account server: %3.

Fields #

Name	Description
`RequestType` UInt32
`cid` AnsiString
`ErrorCode` UInt32	4 environment received the following error code from the Microsoft Account server.
`MachineEnvironment` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 6114,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018429487122,
    "time_created": "2026-05-28T22:43:17.9513552+00:00",
    "event_record_id": 289,
    "correlation": {},
    "execution": {
      "process_id": 4016,
      "thread_id": 4032
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "RequestType": "1",
    "cid": "NULL",
    "ErrorCode": "2147769382",
    "MachineEnvironment": "production"
  },
  "message": "SOAP Request of type Service for user CID 'NULL' in production environment received the following error code from the Microsoft Account server: 0x80045C26."
}

Event ID 6115: ## SOAP Request: Value.

Channel: Operational
Level: Informational
Opcode: Info

Message #

## SOAP Request: %1

Fields #

Name	Description
`Value` AnsiString	## SOAP Request.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 6115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018429487104,
    "time_created": "2026-06-13T05:43:09.1677172+00:00",
    "event_record_id": 355,
    "correlation": {},
    "execution": {
      "process_id": 5900,
      "thread_id": 7412
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Value": "<s:Envelope><s:Header><wsa:Action s:mustUnderstand=\"1\">*</wsa:Action><wsa:To s:mustUnderstand=\"1\">*</wsa:To><wsa:MessageID>*</wsa:MessageID><ps:AuthInfo Id=\"PPAuthInfo\"><ps:HostingApp>{67082621-8D18-4333-9C64-10DE93676363}</ps:HostingApp><ps:BinaryVersion>35</ps:BinaryVersion><ps:UIVersion>1</ps:UIVersion><ps:InlineUX>TokenBroker</ps:InlineUX><ps:IsAdmin>1</ps:IsAdmin><ps:Cookies></ps:Cookies><ps:RequestParams>AQAAAAIAAABsYwQAAAAxMDMz</ps:RequestParams><ps:WindowsClientString>9J9iXygdRXfnfCJgrrzqVu+Vdt4ynPvKg/MJR3xBodE=</ps:WindowsClientString><ps:LicenseSignatureKeyVersion>*</ps:LicenseSignatureKeyVersion><ps:ClientCapabilities>1</ps:ClientCapabilities></ps:AuthInfo><wsse:Security><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"devicesoftware\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#tripledes-cbc\"></EncryptionMethod><ds:KeyInfo><ds:KeyName>http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData><wssc:DerivedKeyToken wsu:Id=\"SignKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:RequestedTokenReference><wsse:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID\"/><wsse:Reference URI=\"\"/></wsse:RequestedTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><wsu:Timestamp wsu:Id=\"Timestamp\"><wsu:Created>2026-06-13T05:43:08Z</wsu:Created><wsu:Expires>2026-06-13T05:48:08Z</wsu:Expires></wsu:Timestamp><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><SignedInfo><CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></CanonicalizationMethod><SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\"></SignatureMethod><Reference URI=\"#RST0\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Timestamp\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#PPAuthInfo\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference></SignedInfo><SignatureValue>*</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference URI=\"#SignKey\"/></wsse:SecurityTokenReference></KeyInfo></Signature></wsse:Security></s:Header><s:Body><wst:RequestSecurityToken Id=\"RST0\"><wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType><wsp:AppliesTo><wsa:EndpointReference><wsa:Address>https://watson.telemetry.microsoft.com</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wsp:PolicyReference URI=\"MBI_SSL\"></wsp:PolicyReference></wst:RequestSecurityToken></s:Body></s:Envelope>"
  },
  "message": "## SOAP Request: <s:Envelope><s:Header><wsa:Action s:mustUnderstand=\"1\">*</wsa:Action><wsa:To s:mustUnderstand=\"1\">*</wsa:To><wsa:MessageID>*</wsa:MessageID><ps:AuthInfo Id=\"PPAuthInfo\"><ps:HostingApp>{67082621-8D18-4333-9C64-10DE93676363}</ps:HostingApp><ps:BinaryVersion>35</ps:BinaryVersion><ps:UIVersion>1</ps:UIVersion><ps:InlineUX>TokenBroker</ps:InlineUX><ps:IsAdmin>1</ps:IsAdmin><ps:Cookies></ps:Cookies><ps:RequestParams>AQAAAAIAAABsYwQAAAAxMDMz</ps:RequestParams><ps:WindowsClientString>9J9iXygdRXfnfCJgrrzqVu+Vdt4ynPvKg/MJR3xBodE=</ps:WindowsClientString><ps:LicenseSignatureKeyVersion>*</ps:LicenseSignatureKeyVersion><ps:ClientCapabilities>1</ps:ClientCapabilities></ps:AuthInfo><wsse:Security><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"devicesoftware\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#tripledes-cbc\"></EncryptionMethod><ds:KeyInfo><ds:KeyName>http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData><wssc:DerivedKeyToken wsu:Id=\"SignKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:RequestedTokenReference><wsse:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID\"/><wsse:Reference URI=\"\"/></wsse:RequestedTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><wsu:Timestamp wsu:Id=\"Timestamp\"><wsu:Created>2026-06-13T05:43:08Z</wsu:Created><wsu:Expires>2026-06-13T05:48:08Z</wsu:Expires></wsu:Timestamp><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><SignedInfo><CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></CanonicalizationMethod><SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\"></SignatureMethod><Reference URI=\"#RST0\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Timestamp\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#PPAuthInfo\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference></SignedInfo><SignatureValue>*</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference URI=\"#SignKey\"/></wsse:SecurityTokenReference></KeyInfo></Signature></wsse:Security></s:Header><s:Body><wst:RequestSecurityToken Id=\"RST0\"><wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType><wsp:AppliesTo><wsa:EndpointReference><wsa:Address>https://watson.telemetry.microsoft.com</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wsp:PolicyReference URI=\"MBI_SSL\"></wsp:PolicyReference></wst:RequestSecurityToken></s:Body></s:Envelope>"
}

Community Notes #

Windows LiveId sign-in activity.

Event ID 6116: ## SOAP Response: Value.

Channel: Operational
Level: Informational
Opcode: Info

Message #

## SOAP Response: %1

Fields #

Name	Description
`Value` AnsiString	## SOAP Response.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 6116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018429487104,
    "time_created": "2026-06-13T05:43:09.3787050+00:00",
    "event_record_id": 356,
    "correlation": {},
    "execution": {
      "process_id": 5900,
      "thread_id": 7412
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Value": "<S:Envelope><S:Header><wsa:Action wsu:Id=\"Action\" S:mustUnderstand=\"1\">*</wsa:Action><wsa:To wsu:Id=\"To\" S:mustUnderstand=\"1\">*</wsa:To><wsse:Security><wsu:Timestamp wsu:Id=\"TS\"><wsu:Created>2026-06-13T05:43:09Z</wsu:Created><wsu:Expires>2026-06-13T05:48:09Z</wsu:Expires></wsu:Timestamp><wssc:DerivedKeyToken wsu:Id=\"SignKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:SecurityTokenReference><wsse:Reference URI=\"0ttIX4ltYOk74jhjCklfsDg38uc=\"></wsse:Reference></wsse:SecurityTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><wssc:DerivedKeyToken wsu:Id=\"EncKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:SecurityTokenReference><wsse:Reference URI=\"0ttIX4ltYOk74jhjCklfsDg38uc=\"></wsse:Reference></wsse:SecurityTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><SignedInfo><CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></CanonicalizationMethod><SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\"></SignatureMethod><Reference URI=\"#EncPsf\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Body\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#To\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Action\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#TS\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference></SignedInfo><SignatureValue>*</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference URI=\"#SignKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo></Signature><e:ReferenceList xmlns:e=\"http://www.w3.org/2001/04/xmlenc#\"><e:DataReference URI=\"#RSTR\"/><e:DataReference URI=\"#EncPsf\"/></e:ReferenceList></wsse:Security><psf:EncryptedPP><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"EncPsf\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#aes256-cbc\"></EncryptionMethod><KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><wsse:SecurityTokenReference><wsse:Reference URI=\"#EncKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData></psf:EncryptedPP></S:Header><S:Body wsu:Id=\"Body\"><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"RSTR\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#aes256-cbc\"></EncryptionMethod><KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><wsse:SecurityTokenReference><wsse:Reference URI=\"#EncKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData></S:Body></S:Envelope>"
  },
  "message": "## SOAP Response: <S:Envelope><S:Header><wsa:Action wsu:Id=\"Action\" S:mustUnderstand=\"1\">*</wsa:Action><wsa:To wsu:Id=\"To\" S:mustUnderstand=\"1\">*</wsa:To><wsse:Security><wsu:Timestamp wsu:Id=\"TS\"><wsu:Created>2026-06-13T05:43:09Z</wsu:Created><wsu:Expires>2026-06-13T05:48:09Z</wsu:Expires></wsu:Timestamp><wssc:DerivedKeyToken wsu:Id=\"SignKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:SecurityTokenReference><wsse:Reference URI=\"0ttIX4ltYOk74jhjCklfsDg38uc=\"></wsse:Reference></wsse:SecurityTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><wssc:DerivedKeyToken wsu:Id=\"EncKey\" Algorithm=\"urn:liveid:SP800108_CTR_HMAC_SHA256_DOUBLEDERIVED\"><wsse:SecurityTokenReference><wsse:Reference URI=\"0ttIX4ltYOk74jhjCklfsDg38uc=\"></wsse:Reference></wsse:SecurityTokenReference><wssc:Nonce>*</wssc:Nonce></wssc:DerivedKeyToken><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><SignedInfo><CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></CanonicalizationMethod><SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256\"></SignatureMethod><Reference URI=\"#EncPsf\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Body\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#To\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#Action\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference><Reference URI=\"#TS\"><Transforms><Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"></Transform></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></DigestMethod><DigestValue>*</DigestValue></Reference></SignedInfo><SignatureValue>*</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference URI=\"#SignKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo></Signature><e:ReferenceList xmlns:e=\"http://www.w3.org/2001/04/xmlenc#\"><e:DataReference URI=\"#RSTR\"/><e:DataReference URI=\"#EncPsf\"/></e:ReferenceList></wsse:Security><psf:EncryptedPP><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"EncPsf\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#aes256-cbc\"></EncryptionMethod><KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><wsse:SecurityTokenReference><wsse:Reference URI=\"#EncKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData></psf:EncryptedPP></S:Header><S:Body wsu:Id=\"Body\"><EncryptedData xmlns=\"http://www.w3.org/2001/04/xmlenc#\" Id=\"RSTR\" Type=\"http://www.w3.org/2001/04/xmlenc#Element\"><EncryptionMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#aes256-cbc\"></EncryptionMethod><KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><wsse:SecurityTokenReference><wsse:Reference URI=\"#EncKey\"></wsse:Reference></wsse:SecurityTokenReference></KeyInfo><CipherData><CipherValue>*</CipherValue></CipherData></EncryptedData></S:Body></S:Envelope>"
}

Event ID 6117: Acquired Service token.

Channel: Operational
Level: Informational
Opcode: Info

Message #

Acquired Service token.
ResourceURI: %1
Created: %2
Expires: %3
TokenType: %4
AuthRequired: %5
RequestStatus: %6
HasFlowUrl: %7
HasAuthUrl: %8
HasEndAuthUrl: %9

Fields #

Name	Description
`ResourceURI` AnsiString
`Created` SYSTEMTIME
`Expires` SYSTEMTIME
`TokenType` AnsiString
`AuthRequired` Int32
`RequestStatus` Int32
`HasFlowUrl` Boolean
`HasAuthUrl` Boolean
`HasEndAuthUrl` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 6117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018429487104,
    "time_created": "2026-06-13T05:43:09.3799244+00:00",
    "event_record_id": 357,
    "correlation": {},
    "execution": {
      "process_id": 5900,
      "thread_id": 7412
    },
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ResourceURI": "https://watson.telemetry.microsoft.com",
    "Created": "2026-06-13T05:43:09.0000000Z",
    "Expires": "2026-06-14T05:43:09.0000000Z",
    "TokenType": "urn:passport:delegationcompact",
    "AuthRequired": "0",
    "RequestStatus": "0",
    "HasFlowUrl": "false",
    "HasAuthUrl": "false",
    "HasEndAuthUrl": "false"
  },
  "message": "Acquired Service token.\r\nResourceURI: https://watson.telemetry.microsoft.com\r\nCreated: 1601-01-03T22:32:45.068Z\r\nExpires: 1601-01-03T22:32:45.068Z\r\nTokenType: urn:passport:delegationcompact\r\nAuthRequired: The operation completed successfully.\r\nRequestStatus: The operation completed successfully.\r\nHasFlowUrl: false\r\nHasAuthUrl: false\r\nHasEndAuthUrl: false"
}

Community Notes #

Windows LiveId sign-in activity.

Event ID 7000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 7001: description @FileName_LineNumber.

Channel: Operational
Level: Error
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 9836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.162Z",
    "version": 0
  },
  "event_data": {
    "FileName": "utilities.cpp",
    "LineNumber": 141,
    "description": "GetCallingProcessHandle returned the current process handle."
  },
  "message": ""
}

Event ID 7002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 7003: description @FileName_LineNumber.

Channel: Operational
Level: Informational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7003,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.166Z",
    "version": 0
  },
  "event_data": {
    "FileName": "identitystorage.cpp",
    "LineNumber": 131,
    "description": "Time skew = -30"
  },
  "message": ""
}

Event ID 7004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 7005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 7006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 7007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 7008: +.

Channel: Operational
Level: Verbose
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7008,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 9836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.161Z",
    "version": 0
  },
  "event_data": {
    "FileName": "onlineidsystemauthenticator.cpp",
    "FunctionName": "Windows::Security::Authentication::OnlineId::OnlineIdSystemAuthenticator::get_Default",
    "LineNumber": 47,
    "description": "NULL"
  },
  "message": ""
}

Event ID 7009: -.

Channel: Operational
Level: Verbose
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7009,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 9836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.161Z",
    "version": 0
  },
  "event_data": {
    "ErrorCode": 0,
    "FunctionName": "Windows::Security::Authentication::OnlineId::OnlineIdSystemAuthenticator::get_Default"
  },
  "message": ""
}

Event ID 7010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 7011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 7012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 7013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 7014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 7015: description @FileName_LineNumber.

Channel: Operational
Level: Verbose
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7015,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 9836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.161Z",
    "version": 0
  },
  "event_data": {
    "FileName": "FieldAccessor.h",
    "LineNumber": 110,
    "description": "put: 'https://events.data.microsoft.com'"
  },
  "message": ""
}

Event ID 7016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 7100: Cached ticket for site Uri and policy Policy found which is valid for another TimeToLive seconds.

Channel: Operational
Level: Informational
Opcode: Info

Message #

Cached ticket for site %1 and policy %2 found which is valid for another %3 seconds.

Fields #

Name	Description
`Uri` UnicodeString
`Policy` UnicodeString
`TimeToLive` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7100,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 1948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.168Z",
    "version": 0
  },
  "event_data": {
    "Policy": "NFS_1wk_compact_SSL",
    "TimeToLive": 548060,
    "Uri": "https://events.data.microsoft.com"
  },
  "message": ""
}

Event ID 7101: ApplicationId Overwritten [value1] becomes [value2].

Channel: Operational
Opcode: Info

Message #

ApplicationId Overwritten [%1] becomes [%2]

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 7102: ApplicationId [value].

Channel: Operational
Level: Informational
Opcode: Info

Message #

ApplicationId [%1]

Fields #

Name	Description
`value` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-LiveId/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7102,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 9836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-LiveId",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:41:53.162Z",
    "version": 0
  },
  "event_data": {
    "value": "{2B379600-B42B-4FE9-A59C-A312FB934935}"
  },
  "message": ""
}

Event ID 7103: Cached ticket for site value1 and policy value2 not found or has expired.

Channel: Operational
Opcode: Info

Message #

Cached ticket for site %1 and policy %2 not found or has expired.

Fields #

Name	Description
`value1` UnicodeString
`value2` UnicodeString

Event ID 7104: Attempts = [Attempts], latestIterationResult = [latestIterationResult], continueRetry = [continueRetry], isConnected = [isConnected], flowUrl = [flowUrl], defaultUser = [defaultUser], promptType = ...

Channel: Operational
Opcode: Info

Description

Attempts = [Attempts], latestIterationResult = [latestIterationResult], continueRetry = [continueRetry], isConnected = [isConnected], flowUrl = [flowUrl], defaultUser = [defaultUser], promptType = [promptType], authUrl = [authUrl], endAuthUrl = [authUrl].

Message #

Attempts = [%1], latestIterationResult = [%2], continueRetry = [%3], isConnected = [%4], flowUrl = [%5], defaultUser = [%6], promptType = [%7], authUrl = [%8], endAuthUrl = [%8]

Fields #

Name	Description
`Attempts` UInt32
`latestIterationResult` UInt32
`continueRetry` Boolean
`isConnected` Boolean
`flowUrl` UnicodeString
`defaultUser` UnicodeString
`promptType` UInt32
`authUrl` UnicodeString
`endAuthUrl` UnicodeString

Event ID 7105: WLIDCPersistCredential [value].

Channel: Operational
Opcode: Info

Message #

WLIDCPersistCredential [%1]

Fields #

Name	Description
`value` UnicodeString

Event ID 8000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 8005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 8006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 8007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 8008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 8010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 8011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 8012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 8013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 8014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 8015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 8016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 9001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 9002: description @FileName_LineNumber.

Channel: Operational
Also via: realtime ETW trace
Level: Warning
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9002,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004020",
    "time_created": "2026-06-02T05:58:08.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "systemstorelite.cpp",
    "LineNumber": 284,
    "description": "SystemStore property not found."
  },
  "message": ""
}

Event ID 9003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 9004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9008: +.

Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9008,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004008",
    "time_created": "2026-06-02T05:58:08.717+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "windowsliveprovider.cpp",
    "FunctionName": "CWindowsLiveProvider::IsConnected",
    "LineNumber": 1781,
    "description": "NULL"
  },
  "message": ""
}

Event ID 9009: -.

Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9009,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004008",
    "time_created": "2026-06-02T05:58:08.718+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ErrorCode": 0,
    "FunctionName": "SystemStoreLite::GetCurrentUserSidString"
  },
  "message": ""
}

Event ID 9010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 9011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 9012: Process name ProcessName.

Channel: Operational
Also via: realtime ETW trace
Level: Error
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9012,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004002",
    "time_created": "2026-06-02T05:58:08.717+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-234C-90720FEEDC01}"
    },
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProcessName": "C:\\WINDOWS\\system32\\taskhostw.exe"
  },
  "message": ""
}

Event ID 9013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 9014: -.

Channel: Operational
Also via: realtime ETW trace
Level: Warning
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9014,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004028",
    "time_created": "2026-06-02T05:58:08.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ErrorCode": -2147023728,
    "FunctionName": "SystemStoreLite::GetStoredIdentityProperty"
  },
  "message": ""
}

Event ID 9015: description @FileName_LineNumber.

Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-LiveId",
    "guid": "{05F02597-FE85-4E67-8542-69567AB8FD4F}",
    "event_source_name": "",
    "event_id": 9015,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000004000",
    "time_created": "2026-06-02T05:58:08.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 15568,
      "thread_id": 9292
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileName": "ErrorHandlingUtilities.h",
    "LineNumber": 252,
    "description": "Internal Error: 0x0, Collapsed Internal Error: 0x0, External Error: 0x0, isUserActionable: 0"
  },
  "message": ""
}

Event ID 9016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 9100: WLIDCPersistCredential [value].

Channel: Operational
Opcode: Info

Message #

WLIDCPersistCredential [%1]

Fields #

Name	Description
`value` UnicodeString

Event ID 10000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 10005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 10006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 10007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 10008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 10010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 10011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 10012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 10013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 10014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 10015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 10016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 11000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 11005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 11006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 11007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 11008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 11010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 11011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 11012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 11013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 11014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 11015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 11016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 12000: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12001: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12002: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12003: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12004: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 12005: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 12006: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 12007: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Event ID 12008: +.

Channel: Operational
Opcode: Info

Description

+FunctionName@FileName_LineNumber

Message #

+%2@%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12009: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 12010: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 12011: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=Address

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`Address` Pointer

Event ID 12012: Process name ProcessName.

Channel: Operational
Opcode: Info

Message #

Process name %1

Fields #

Name	Description
`ProcessName` UnicodeString

Event ID 12013: IF_FAILEXIT failure: (Expression), hr = ErrorCode, in FunctionName @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

IF_FAILEXIT failure: (%4), hr = %5, in %2 @%1_%3

Fields #

Name	Description
`FileName` AnsiString
`FunctionName` AnsiString
`LineNumber` UInt32
`Expression` AnsiString
`ErrorCode` Int32

Event ID 12014: -.

Channel: Operational
Opcode: Info

Description

-FunctionName=ErrorCode

Message #

-%1=%2

Fields #

Name	Description
`FunctionName` AnsiString
`ErrorCode` Int32

Event ID 12015: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` UnicodeString

Event ID 12016: description @FileName_LineNumber.

Channel: Operational
Opcode: Info

Message #

%3 @%1_%2

Fields #

Name	Description
`FileName` AnsiString
`LineNumber` UInt32
`description` AnsiString

Provenance

ETW provider GUID {05F02597-FE85-4E67-8542-69567AB8FD4F}

Defined in wlidres.dll, which carries the event manifest.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB