Microsoft-Windows-OnlineResponder

Event	Title	Channel	Sample	Rule
17	Online Responder Service was started.	Application	Y	N
17	Event ID 17	Operational	N	N
18	Online Responder Service was stopped.	Application	Y	N
18	Event ID 18	Operational	N	N
20	The Online Responder Service did not start: ErrorCode.	Application	N	N
20	Event ID 20	Operational	N	N
21	FileIdentifier: The Online Responder Service detected an exception at address …	Application	N	N
21	Event ID 21	Operational	N	N
22	OCSP Responder Services did not process an extremely long request from …	Application	N	N
22	Event ID 22	Operational	N	N
23	The Online Responder Service could not locate a signing certificate for …	Application	N	N
23	Event ID 23	Operational	N	N
24	The Online Responder Service successfully (re)loaded a signing certificate for …	Application	N	N
24	Event ID 24	Operational	N	N
25	The signing certificate for Online Responder configuration CAConfigurationId …	Application	N	N
25	Event ID 25	Operational	N	N
26	The signing certificate for Online Responder configuration CAConfigurationId has …	Application	N	N
26	Event ID 26	Operational	N	N
27	The signing certificate for Online Responder configuration CAConfigurationId was …	Application	N	N
27	Event ID 27	Operational	N	N
28	The signing certificate for Online Responder configuration CAConfigurationId has …	Application	N	N
28	Event ID 28	Operational	N	N
29	Settings for Online Responder configuration CAConfigurationId cannot be loaded.	Application	N	N
29	Event ID 29	Operational	N	N
31	Performance counters for the Online Responder Service cannot be initialized.	Application	N	N
31	Event ID 31	Operational	N	N
32	The Online Responder Service detected a change in the signing certificate …	Application	N	N
32	Event ID 32	Operational	N	N
33	The Online Responder Service failed to create an enrollment request for the …	Application	N	N
33	Event ID 33	Operational	N	N
34	The Online Responder Service encountered an error while submitting the …	Application	N	N
34	Event ID 34	Operational	N	N
35	The Online Responder Service failed to install the enrollment response for …	Application	N	N
35	Event ID 35	Operational	N	N
36	The Online Responder Service successfully enrolled for a new signing certificate …	Application	N	N
36	Event ID 36	Operational	N	N
37	The signing certificate for Online Responder configuration CAConfigurationId …	Application	N	N
37	Event ID 37	Operational	N	N

Event ID 17: Online Responder Service was started.

Channel: Application
Level: 4

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-OnlineResponder",
    "guid": "{21b2e773-ebed-4ce1-834a-1444f9e20d6e}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-05-08 17:33:26.099514+00:00",
    "event_record_id": 475,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 2272,
      "thread_id": 7252
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 17

Channel: Operational

Description

Online Responder Service was started.

Event ID 18: Online Responder Service was stopped.

Channel: Application
Level: 4

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-OnlineResponder",
    "guid": "{21b2e773-ebed-4ce1-834a-1444f9e20d6e}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-05-08 18:03:33.590929+00:00",
    "event_record_id": 535,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 2272,
      "thread_id": 7252
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 18

Channel: Operational

Description

Online Responder Service was stopped.

Event ID 20: The Online Responder Service did not start: ErrorCode.

Channel: Application

Message #

The Online Responder Service did not start: %1.

Fields #

Name	Description
`ErrorCode` UnicodeString

Event ID 20

Channel: Operational

Description

The Online Responder Service did not start: .

Fields #

Name	Description
`ErrorCode` UnicodeString

Event ID 21: FileIdentifier: The Online Responder Service detected an exception at address ExceptionAddress.

Channel: Application

Description

FileIdentifier: The Online Responder Service detected an exception at address ExceptionAddress. Flags = ExeptionFlags. The exception is ErrorCode.

Message #

%1: The Online Responder Service detected an exception at address %2.  Flags = %3.  The exception is %4.

Fields #

Name	Description
`FileIdentifier` UnicodeString
`ExceptionAddress` UnicodeString
`ExeptionFlags` UnicodeString
`ErrorCode` UnicodeString

Event ID 21

Channel: Operational

Description

: The Online Responder Service detected an exception at address . Flags = . The exception is .

Fields #

Name	Description
`FileIdentifier` UnicodeString
`ExceptionAddress` UnicodeString
`ExeptionFlags` UnicodeString
`ErrorCode` UnicodeString

Event ID 22: OCSP Responder Services did not process an extremely long request from RequestName.

Channel: Application

Description

OCSP Responder Services did not process an extremely long request from RequestName. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. Unless exhaustive logging is enabled, this error will only be logged every 20 minutes.

Message #

OCSP Responder Services did not process an extremely long request from %1. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. Unless exhaustive logging is enabled, this error will only be logged every 20 minutes.

Fields #

Name	Description
`RequestName` UnicodeString

Event ID 22

Channel: Operational

Fields #

Name	Description
`RequestName` UnicodeString

Event ID 23: The Online Responder Service could not locate a signing certificate for configuration CAConfigurationId.

Channel: Application

Description

The Online Responder Service could not locate a signing certificate for configuration CAConfigurationId.(ErrorCode).

Message #

The Online Responder Service could not locate a signing certificate for configuration %1.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 23

Channel: Operational

Description

The Online Responder Service could not locate a signing certificate for configuration .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 24: The Online Responder Service successfully (re)loaded a signing certificate for configuration CAConfigurationId.

Channel: Application

Message #

The Online Responder Service successfully (re)loaded a signing certificate for configuration %1.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 24

Channel: Operational

Description

The Online Responder Service successfully (re)loaded a signing certificate for configuration .

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 25: The signing certificate for Online Responder configuration CAConfigurationId will expire soon.

Channel: Application

Message #

The signing certificate for Online Responder configuration %1 will expire soon.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 25

Channel: Operational

Description

The signing certificate for Online Responder configuration will expire soon.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 26: The signing certificate for Online Responder configuration CAConfigurationId has expired.

Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId has expired. OCSP requests for this configuration will be rejected.

Message #

The signing certificate for Online Responder configuration %1 has expired. OCSP requests for this configuration will be rejected.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 26

Channel: Operational

Description

The signing certificate for Online Responder configuration has expired. OCSP requests for this configuration will be rejected.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 27: The signing certificate for Online Responder configuration CAConfigurationId was not updated.

Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId was not updated.(ErrorCode).

Message #

The signing certificate for Online Responder configuration %1 was not updated.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 27

Channel: Operational

Description

The signing certificate for Online Responder configuration was not updated.().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 28: The signing certificate for Online Responder configuration CAConfigurationId has been renewed.

Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId has been renewed. The hash for the new certificate can be located in additional data.

Message #

The signing certificate for Online Responder configuration %1 has been renewed. The hash for the new certificate can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 28

Channel: Operational

Description

The signing certificate for Online Responder configuration has been renewed. The hash for the new certificate can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 29: Settings for Online Responder configuration CAConfigurationId cannot be loaded.

Channel: Application

Description

Settings for Online Responder configuration CAConfigurationId cannot be loaded. OCSP requests for this configuration will be rejected.(ErrorCode).

Message #

Settings for Online Responder configuration %1 cannot be loaded. OCSP requests for this configuration will be rejected.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 29

Channel: Operational

Description

Settings for Online Responder configuration cannot be loaded. OCSP requests for this configuration will be rejected.().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 31: Performance counters for the Online Responder Service cannot be initialized.

Channel: Application

Event ID 31

Channel: Operational

Description

Performance counters for the Online Responder Service cannot be initialized.

Event ID 32: The Online Responder Service detected a change in the signing certificate template version for configuration CAConfigurationId.

Channel: Application

Description

The Online Responder Service detected a change in the signing certificate template version for configuration CAConfigurationId. The old version was (OldMajorVersion,OldMinorVersion), the new version is (NewMajorVersion,NewMinorVersion).

Message #

The Online Responder Service detected a change in the signing certificate template version for configuration %1. The old version was (%2,%3), the new version is (%4,%5).

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`OldMajorVersion` UnicodeString
`OldMinorVersion` UnicodeString
`NewMajorVersion` UnicodeString
`NewMinorVersion` UnicodeString

Event ID 32

Channel: Operational

Description

The Online Responder Service detected a change in the signing certificate template version for configuration . The old version was (,), the new version is (,).

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`OldMajorVersion` UnicodeString
`OldMinorVersion` UnicodeString
`NewMajorVersion` UnicodeString
`NewMinorVersion` UnicodeString

Event ID 33: The Online Responder Service failed to create an enrollment request for the signing certificate template CertificateTemplateName for configuration CAConfigurationId.

Channel: Application

Description

The Online Responder Service failed to create an enrollment request for the signing certificate template CertificateTemplateName for configuration CAConfigurationId.(ErrorCode).

Message #

The Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`ErrorCode` UnicodeString

Event ID 33

Channel: Operational

Description

The Online Responder Service failed to create an enrollment request for the signing certificate template for configuration .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`ErrorCode` UnicodeString

Event ID 34: The Online Responder Service encountered an error while submitting the enrollment request for configuration CAConfigurationId to certification authority CAConfig.

Channel: Application

Description

The Online Responder Service encountered an error while submitting the enrollment request for configuration CAConfigurationId to certification authority CAConfig. The request ID is RequestId.(ErrorCode).

Message #

The Online Responder Service encountered an error while submitting the enrollment request for configuration %1 to certification authority %2. The request ID is %3.(%4)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CAConfig` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 34

Channel: Operational

Description

The Online Responder Service encountered an error while submitting the enrollment request for configuration to certification authority . The request ID is .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CAConfig` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 35: The Online Responder Service failed to install the enrollment response for configuration CAConfigurationId for the signing certificate template CertificateTemplateName .

Channel: Application

Description

The Online Responder Service failed to install the enrollment response for configuration CAConfigurationId for the signing certificate template CertificateTemplateName . The request ID is RequestId.(ErrorCode).

Message #

The Online Responder Service failed to install the enrollment response for configuration %1 for the signing certificate template %2 . The request ID is %3.(%4)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 35

Channel: Operational

Description

The Online Responder Service failed to install the enrollment response for configuration for the signing certificate template . The request ID is .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 36: The Online Responder Service successfully enrolled for a new signing certificate for configuration CAConfigurationId.

Channel: Application

Description

The Online Responder Service successfully enrolled for a new signing certificate for configuration CAConfigurationId. The new certificate's hash can be located in additional data.

Message #

The Online Responder Service successfully enrolled for a new signing certificate for configuration %1. The new certificate's hash can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 36

Channel: Operational

Description

The Online Responder Service successfully enrolled for a new signing certificate for configuration . The new certificate's hash can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 37: The signing certificate for Online Responder configuration CAConfigurationId does not include the mandatory OCSP No Revocation Checking extension.

Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId does not include the mandatory OCSP No Revocation Checking extension. You must configure an OCSP Response Signing certificate template to include this extension in all OCSP Response Signing certificates. For more information, see Configure a CA to Support OCSP Responders in the Online Responder console Help.

Message #

The signing certificate for Online Responder configuration %1 does not include the mandatory OCSP No Revocation Checking extension. You must configure an OCSP Response Signing certificate template to include this extension in all OCSP Response Signing certificates. For more information, see Configure a CA to Support OCSP Responders in the Online Responder console Help.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 37

Channel: Operational

Fields #

Name	Description
`CAConfigurationId` UnicodeString