Microsoft-Windows-Security-IdentityListener

Event	Title	Channel	Sample	Rule
0	Successfully imported {Number} identities.	Operation log	N	N
1	Failed to importidentities.	Operation log	N	N
2	Successfully added {Sid} to homeusers group.	Operation log	N	N
3	Failed to add {Sid} to homeusers group.	Operation log	N	N
4	Successfully deleted {Sid} from homeusers group.	Operation log	N	N
5	Failed to delete {Sid} from homeusers group.	Operation log	N	N
6	Machine certificate with {psz} name was created successfully.	Operation log	N	N
7	Failed to create Machine certificate.	Operation log	N	N
8	Certificate was successfully imported for machine {psz}.	Operation log	N	N
9	Importing certificate for machine {RemoteMachineName} failed with error code …	Operation log	N	N
10	Importing Identity (Provider GUID: {ProviderGUID}) Identity UID: {IdentityUID} …	Operation log	N	N
11	Failed to remove remote identities from the ILR cache.	Operation log	N	N
13	Failed to delete machine certificates.	Operation log	N	N
14	Handle the remote machine {psz} departure event.	Operation log	N	N
15	Failed to handle the remote machine {RemoteMachineName} departure event.	Operation log	N	N

Event ID 0: Successfully imported {Number} identities.

Channel: Operation log

Fields #

Name	Description
`Number`

Event ID 1: Failed to importidentities.

Channel: Operation log

Description

Failed to importidentities. Error code: {LastError}.

Message #

Failed to importidentities. Error code: {LastError}

Fields #

Name	Description
`LastError`

Event ID 2: Successfully added {Sid} to homeusers group.

Channel: Operation log

Fields #

Name	Description
`Sid`

Event ID 3: Failed to add {Sid} to homeusers group.

Channel: Operation log

Fields #

Name	Description
`Sid`

Event ID 4: Successfully deleted {Sid} from homeusers group.

Channel: Operation log

Fields #

Name	Description
`Sid`

Event ID 5: Failed to delete {Sid} from homeusers group.

Channel: Operation log

Fields #

Name	Description
`Sid`

Event ID 6: Machine certificate with {psz} name was created successfully.

Channel: Operation log

Fields #

Name	Description
`psz`

Event ID 7: Failed to create Machine certificate.

Channel: Operation log

Description

Failed to create Machine certificate. Error code {LastError}.

Message #

Failed to create Machine certificate. Error code {LastError}

Fields #

Name	Description
`LastError`

Event ID 8: Certificate was successfully imported for machine {psz}.

Channel: Operation log

Fields #

Name	Description
`psz`

Event ID 9: Importing certificate for machine {RemoteMachineName} failed with error code {Errorcode}.

Channel: Operation log

Fields #

Name	Description
`RemoteMachineName`
`Errorcode`

Event ID 10: Importing Identity (Provider GUID: {ProviderGUID}) Identity UID: {IdentityUID} [{IdentityDisplayName}].

Channel: Operation log

Message #

Importing Identity (Provider GUID: {ProviderGUID})  Identity UID: {IdentityUID} [{IdentityDisplayName}].

Fields #

Name	Description
`ProviderGUID`
`IdentityUID`
`IdentityDisplayName`

Event ID 11: Failed to remove remote identities from the ILR cache.

Channel: Operation log

Description

Failed to remove remote identities from the ILR cache. Error code {LastError}.

Message #

Failed to remove remote identities from the ILR cache. Error code {LastError}

Fields #

Name	Description
`LastError`

Event ID 13: Failed to delete machine certificates.

Channel: Operation log

Description

Failed to delete machine certificates. Error code {LastError}.

Message #

Failed to delete machine certificates. Error code {LastError}

Fields #

Name	Description
`LastError`

Event ID 14: Handle the remote machine {psz} departure event.

Channel: Operation log

Fields #

Name	Description
`psz`

Event ID 15: Failed to handle the remote machine {RemoteMachineName} departure event.

Channel: Operation log

Description

Failed to handle the remote machine {RemoteMachineName} departure event. Error code {Errorcode}.

Message #

Failed to handle the remote machine {RemoteMachineName} departure event. Error code {Errorcode}

Fields #

Name	Description
`RemoteMachineName`
`Errorcode`