Microsoft-Windows-Security-IdentityStore

Event	Title	Channel	Sample	Rule
1	CreateConnectedUserStart	Performance	N	N
2	CreateConnectedUserStart2	Performance	N	N
3	CreateConnectedUserStop	Performance	N	N
4	ConnectDisconnectUserStart	Performance	N	N
5	ConnectDisconnectUserStop	Performance	N	N
6	ConnectDisconnectUserStart6	Performance	N	N
7	ConnectDisconnectUserStop7	Performance	N	N
8	ConnectDisconnectUserStart8	Performance	N	N
9	ConnectDisconnectUserStop9	Performance	N	N
10	ConnectDisconnectUserStart10	Performance	N	N
11	ConnectDisconnectUserStop11	Performance	N	N
12	IdentityQueryStart	Performance	N	N
13	IdentityQueryStop	Performance	N	N
14	IdentityQuery	Performance	Y	N
15	IdentityQuery	Performance	Y	N
16	IdentityQuery	Performance	Y	N
17	IdentityQuery	Performance	Y	N
18	IdentityQueryStart18	Performance	N	N
19	IdentityQueryStop19	Performance	N	N
20	IdentityQueryStart20	Performance	N	N
21	IdentityQueryStop21	Performance	N	N
22	CreateConnectedUserStart22	Performance	N	N
23	CreateConnectedUserStop23	Performance	N	N
24	CreateConnectedUserStart24	Performance	N	N
25	CreateConnectedUserStop25	Performance	N	N
26	ConnectDisconnectUserStart26	Performance	N	N
27	ConnectDisconnectUserStop27	Performance	N	N

Event ID 1: CreateConnectedUserStart

Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 2: CreateConnectedUserStart2

Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 3: CreateConnectedUserStop

Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 4: ConnectDisconnectUserStart

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 5: ConnectDisconnectUserStop

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 6: ConnectDisconnectUserStart6

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 7: ConnectDisconnectUserStop7

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 8: ConnectDisconnectUserStart8

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 9: ConnectDisconnectUserStop9

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 10: ConnectDisconnectUserStart10

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 11: ConnectDisconnectUserStop11

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Event ID 12: IdentityQueryStart

Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 13: IdentityQueryStop

Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 14: IdentityQuery

Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.425+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 15: IdentityQuery

Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.519+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 16: IdentityQuery

Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.515+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 17: IdentityQuery

Channel: Performance
Level: Informational
Task: IdentityQuery
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-IdentityStore",
    "guid": "{00B7E1DF-B469-4C69-9C41-53A6576E3DAD}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:02:39.516+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17172,
      "thread_id": 13652
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "IdentityQuery"
}

Event ID 18: IdentityQueryStart18

Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 19: IdentityQueryStop19

Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 20: IdentityQueryStart20

Channel: Performance
Task: IdentityQuery
Opcode: Start

Event ID 21: IdentityQueryStop21

Channel: Performance
Task: IdentityQuery
Opcode: Stop

Event ID 22: CreateConnectedUserStart22

Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 23: CreateConnectedUserStop23

Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 24: CreateConnectedUserStart24

Channel: Performance
Task: CreateConnectedUser
Opcode: Start

Event ID 25: CreateConnectedUserStop25

Channel: Performance
Task: CreateConnectedUser
Opcode: Stop

Event ID 26: ConnectDisconnectUserStart26

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Start

Event ID 27: ConnectDisconnectUserStop27

Channel: Performance
Task: ConnectDisconnectUser
Opcode: Stop

Provenance

ETW provider GUID {00B7E1DF-B469-4C69-9C41-53A6576E3DAD}

Defined in idstore.dll, which carries the event manifest.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB