Microsoft-Windows-Security-Vault
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 100 | CPasswordVaultAdd start | Performance | N | N |
| 101 | CPasswordVaultAdd stop | Performance | N | N |
| 102 | CPasswordVaultRemove start | Performance | N | N |
| 103 | CPasswordVaultRemove stop | Performance | N | N |
| 104 | CPasswordVaultRetrieve start | Performance | N | N |
| 105 | CPasswordVaultRetrieve stop | Performance | N | N |
| 106 | CPasswordVaultFindAllByResource start | Performance | N | N |
| 107 | CPasswordVaultFindAllByResource stop | Performance | N | N |
| 108 | CPasswordVaultFindAllByUserName start | Performance | N | N |
| 109 | CPasswordVaultFindAllByUserName stop | Performance | N | N |
| 110 | CPasswordVaultRetrieveAll start | Performance | N | N |
| 111 | CPasswordVaultRetrieveAll stop | Performance | N | N |
Event ID 100: CPasswordVaultAdd start
#Event ID 101: CPasswordVaultAdd stop
#Event ID 102: CPasswordVaultRemove start
#Event ID 103: CPasswordVaultRemove stop
#Event ID 104: CPasswordVaultRetrieve start
#Event ID 105: CPasswordVaultRetrieve stop
#Event ID 106: CPasswordVaultFindAllByResource start
#Event ID 107: CPasswordVaultFindAllByResource stop
#Event ID 108: CPasswordVaultFindAllByUserName start
#Event ID 109: CPasswordVaultFindAllByUserName stop
#Event ID 110: CPasswordVaultRetrieveAll start
#Event ID 111: CPasswordVaultRetrieveAll stop
#Provenance
ETW provider GUID e6c92fb8-89d7-4d1f-be46-d56e59804783
Defined in vaultcli.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB