Microsoft-Windows-Shell-AuthUI

291 events across 8 channels

Event	Title	Channel	Sample
5001	Logon user interface creation failed.	Operational	N
5002	Logon user interface RPC server startup failed.	Operational	N
5003	The username/password credential provider failed to enumerate tiles.	Operational	N
5004	Autologon failed.	Operational	N
5005	The autologon password could not be loaded.	Operational	N
5006	The autologon password could not be loaded.	Operational	N
5007	The OEM background could not be loaded for resolution DWORD1 x DWORD2.	Operational	N
5008	The OEM background Error was loaded but its aspect ratio does not match the …	Operational	N
5009	The OEM background Error was not loaded because the file is larger than DWORD1 …	Operational	N
5010	The credential provider thread creation failed.	Operational	N
5011	User enumeration failed.	Operational	N
5012	The first run task for package PackageFullName exceeded the maximum runtime …	Operational	N
5013	The autologon setting has been removed because AutoLogonSettingRemovalReason.	Operational	N
15001	Common_UserList_TileEnumerationStart	Diagnostic	N
15002	Common_UserList_TileEnumerationStop	Diagnostic	N
15003	Common_GetMachineNameStart	Diagnostic	N
15004	Common_GetMachineNameStop	Diagnostic	N
15005	Common_GetMachineDomainNameStart	Diagnostic	N
15006	Common_GetMachineDomainNameStop	Diagnostic	N
15007	Common_GetBuiltInAdministratorStart	Diagnostic	N
15008	Common_GetBuiltInAdministratorStop	Diagnostic	N
15009	Common_GetInSessionUserStart	Diagnostic	N
15010	Common_GetInSessionUserStop	Diagnostic	N
15011	Common_GetFriendlyNameStart	Diagnostic	N
15012	Common_GetFriendlyNameStop	Diagnostic	N
15013	Common_Tile_FireSubmitEvent	Diagnostic	N
15014	Common_CreateCredentialProvidersStart	Diagnostic	N
15015	Common_CreateCredentialProvidersStop	Diagnostic	N
15016	Common_AddCredProvider	Diagnostic	N
15017	Common_CreateCredProviderThreadStart	Diagnostic	N
15018	Common_CreateCredProviderThreadStop	Diagnostic	N
15019	Common_CredProviderThreadProcStart	Diagnostic	N
15020	Common_CredProviderThreadProcStop	Diagnostic	N
15021	Common_CredProviderThreadDestroyStart	Diagnostic	N
15022	Common_CredProviderThreadDestroyStop	Diagnostic	N
15023	Common_SetUsageScenario	Diagnostic	N
15024	Common_SetSerialization	Diagnostic	N
15025	Common_GetCredentialAt	Diagnostic	N
15026	Common_GetCredentialCount	Diagnostic	N
15027	Common_GetFieldDescriptorCount	Diagnostic	N
15028	Common_Credential_GetUserSid	Diagnostic	N
15029	Common_SetSelected	Diagnostic	N
15030	Common_SetDeSelected	Diagnostic	N
15031	Common_GetSerialization	Diagnostic	N
15032	Common_ReportResult	Diagnostic	N
15033	Common_RegisterEnumerationStart	Diagnostic	N
15034	Common_RegisterEnumerationStop	Diagnostic	N
15035	Common_CreateEnumerationSyncReply	Diagnostic	N
15036	Common_StartCredProvsForUsageScenario	Diagnostic	N
25001	Logon_ServerCallback_AbortStart	Diagnostic	N
25002	Logon_ServerCallback_AbortStop	Diagnostic	N
25003	Logon_ServerCallback_DisplayLockedStart	Diagnostic	N
25004	Logon_ServerCallback_DisplayLockedStop	Diagnostic	N
25005	Logon_ServerCallback_DisplayMessageStart	Diagnostic	N
25006	Logon_ServerCallback_DisplayMessageStop	Diagnostic	N
25007	Logon_ServerCallback_DisplayRequestCredentialsErrorStart	Diagnostic	N
25008	Logon_ServerCallback_DisplayRequestCredentialsErrorStop	Diagnostic	N
25009	Logon_ServerCallback_DisplaySecurityOptionsStart	Diagnostic	N
25010	Logon_ServerCallback_DisplaySecurityOptionsStop	Diagnostic	N
25011	Logon_ServerCallback_DisplayStatusStart	Diagnostic	N
25012	Logon_ServerCallback_DisplayStatusStop	Diagnostic	N
25013	Logon_ServerCallback_DisplayWelcomeStart	Diagnostic	N
25014	Logon_ServerCallback_DisplayWelcomeStop	Diagnostic	N
25015	Logon_ServerCallback_ReportResultStart	Diagnostic	N
25016	Logon_ServerCallback_ReportResultStop	Diagnostic	N
25017	Logon_ServerCallback_RequestCredentialsStart	Diagnostic	N
25018	Logon_ServerCallback_RequestCredentialsStop	Diagnostic	N
25019	Logon_ServerCallback_ShutdownStart	Diagnostic	N
25020	Logon_ServerCallback_ShutdownStop	Diagnostic	N
25021	Logon_ServerCallback_PromptForCredentialsStart	Diagnostic	N
25022	Logon_ServerCallback_PromptForCredentialsStop	Diagnostic	N
25023	Logon_LogonFrame_OnSwitchUserStart	Diagnostic	N
25024	Logon_LogonFrame_OnSwitchUserStop	Diagnostic	N
25025	Logon_LogonFrame_OnOtherTilesStart	Diagnostic	N
25026	Logon_LogonFrame_OnOtherTilesStop	Diagnostic	N
25027	Logon_LogonFrame_OnGetEnumeratedTilesReplyStart	Diagnostic	N
25028	Logon_LogonFrame_OnGetEnumeratedTilesReplyStop	Diagnostic	N
25029	Logon_LogonFrame_OnEnumerationSyncReplyStart	Diagnostic	N
25030	Logon_LogonFrame_OnEnumerationSyncReplyStop	Diagnostic	N
25031	Logon_LogonFrame_OnSelectCredentialReplyStart	Diagnostic	N
25032	Logon_LogonFrame_OnSelectCredentialReplyStop	Diagnostic	N
25033	Logon_LogonFrame_SetBackgroundGraphicsStart	Diagnostic	N
25034	Logon_LogonFrame_SetBackgroundGraphicsStop	Diagnostic	N
25035	Logon_LogonFrame_InitializeFrameStart	Diagnostic	N
25036	Logon_LogonFrame_InitializeFrameStop	Diagnostic	N
25037	Logon_LogonFrame_CreateStyleParserStart	Diagnostic	N
25038	Logon_LogonFrame_CreateStyleParserStop	Diagnostic	N
25039	Logon_LogonFrame_CreateFrameElementStart	Diagnostic	N
25040	Logon_LogonFrame_CreateFrameElementStop	Diagnostic	N
25041	Logon_LogonFrame_InitializeUserListsStart	Diagnostic	N
25042	Logon_LogonFrame_InitializeUserListsStop	Diagnostic	N
25043	Logon_LogonFrame_BrandingLoadImageStart	Diagnostic	N
25044	Logon_LogonFrame_BrandingLoadImageStop	Diagnostic	N
25047	Logon_LogonFrame_InitializeSoftKeyboardStart	Diagnostic	N
25048	Logon_LogonFrame_InitializeSoftKeyboardStop	Diagnostic	N
25049	Logon_LogonFrame_WTSRegisterSessionNotificationStart	Diagnostic	N
25050	Logon_LogonFrame_WTSRegisterSessionNotificationStop	Diagnostic	N
25051	Logon_AutoLogon_IsSingleUserNoPasswordStart	Diagnostic	N
25052	Logon_AutoLogon_IsSingleUserNoPasswordStop	Diagnostic	N
25053	Logon_AutoLogon_IsLocalNoPasswordUserStart	Diagnostic	N
25054	Logon_AutoLogon_IsSingleUserNoPasswordStop25054	Diagnostic	N
25055	Logon_ServerStartupStart	Diagnostic	N
25056	Logon_ServerStartupStop	Diagnostic	N
25057	Logon_LaunchToReadyForInputStart	Diagnostic	N
25058	Logon_LaunchToReadyForInputStop	Diagnostic	N
25059	Logon_CredentialsToExitStart	Diagnostic	N
25060	Logon_CredentialsToExitStop	Diagnostic	N
25061	Logon_RequestCredentialsToReadyForCredentialsStart	Diagnostic	N
25062	Logon_RequestCredentialsToReadyForCredentialsStop	Diagnostic	N
25063	Logon_LaunchToAnimationCompleteStart	Diagnostic	N
25064	Logon_LaunchToAnimationCompleteStop	Diagnostic	N
25065	LogonUI_PerfTrack_UserSwitchingStop	Diagnostic	N
25066	Logon_RequestCredentialsToCancelAfterEnumerateStop	Diagnostic	N
25068	Logon_LaunchToCancelAfterResumeStop	Diagnostic	N
25072	LogonUI_SubmitCredentialToExitStart	Diagnostic	N
25073	LogonUI_SubmitCredentialToExitStop	Diagnostic	N
25074	Logon_LogonFrame_OnGetSerializationReply	Diagnostic	N
25075	Logon_LogonFrame_OnProviderCredentialsChanged	Diagnostic	N
25076	Logon_LogonFrame_DisplayStatusMessage	Diagnostic	N
25077	Logon_LogonFrame_LogonDialogCallback	Diagnostic	N
25078	Logon_LogonFrame_DisplayLogonDialog	Diagnostic	N
25079	Logon_Background_GetBackgroundForUser	Diagnostic	N
25080	Logon_Background_ShowUserBackground	Diagnostic	N
25082	Logon_AccessPage_LoadBackgroundImageStart	Diagnostic	N
25083	Logon_AccessPage_LoadBackgroundImageStop	Diagnostic	N
25084	Logon_AutoLogon_QueryAutoLogon_Info	Diagnostic	N
25085	Logon_AutoLogon_IgnoreAutoLogonMode_Info	Diagnostic	N
25087	Logon_BSDR_InitializeStart	Diagnostic	N
25088	Logon_BSDR_InitializeStop	Diagnostic	N
25089	Logon_BSDR_Shown	Diagnostic	N
25090	Logon_BSDR_AddApplicationStart	Diagnostic	N
25091	Logon_BSDR_AddApplicationStop	Diagnostic	N
25093	Logon_BSDR_RemoveApplicationStart	Diagnostic	N
25094	Logon_BSDR_RemoveApplicationStop	Diagnostic	N
25095	LogonUI_SubmitCredentialToExitStop25095	Diagnostic	N
25096	LogonUI_PerfTrack_LockStop	Diagnostic	N
25097	Logon_LanguageProfile_SwitchInputMethodsStart	Diagnostic	N
25098	Logon_LanguageProfile_SwitchInputMethodsStop	Diagnostic	N
25099	Logon_AccessPage_CancelFirstRunTasksStart	Diagnostic	N
25100	Logon_AccessPage_CancelFirstRunTasksStop	Diagnostic	N
25101	Logon_AccessPage_CancelFirstRunTasks	Diagnostic	N
25102	Logon_AccessPage_TriggerFirstRunTasksStart	Diagnostic	N
25103	Logon_AccessPage_TriggerFirstRunTasksStop	Diagnostic	N
25104	Logon_AccessPage_WaitForFirstRunTasksStart	Diagnostic	N
25105	Logon_AccessPage_WaitForFirstRunTasksStop	Diagnostic	N
25106	Logon_BackButtonNotificationFlyoutStart	Diagnostic	N
25107	Logon_BackButtonNotificationFlyoutStop	Diagnostic	N
25108	Logon_AccessPage_UnlockStart	Diagnostic	N
25109	Logon_AccessPage_UnlockStop	Diagnostic	N
25110	Logon_AccessPage_LockStart	Diagnostic	N
25111	Logon_AccessPage_LockStop	Diagnostic	N
25112	Logon_AccessPage_Lock	Diagnostic	N
25113	Logon_AccessPage_Camera_ControlCreationStart	Diagnostic	N
25114	Logon_AccessPage_Camera_ControlCreationStop	Diagnostic	N
25115	Logon_AccessPage_Camera_ViewfinderInitializationStart	Diagnostic	N
25116	Logon_AccessPage_Camera_ViewfinderInitializationStop	Diagnostic	N
25117	Logon_AccessPage_Camera_ActiveDurationStart	Diagnostic	N
25118	Logon_AccessPage_Camera_ActiveDurationStop	Diagnostic	N
25119	Logon_AccessPage_Camera_ShutdownDurationStart	Diagnostic	N
25120	Logon_AccessPage_Camera_ShutdownDurationStop	Diagnostic	N
35001	CredUI_Prompt_Called	Diagnostic	N
35002	CredUI_Dialog_CreatedStart	Diagnostic	N
35003	CredUI_Dialog_CreatedStop	Diagnostic	N
35004	CredUI_UserList_TileEnumeration	Diagnostic	N
35005	CredUI_Dialog_Destroyed	Diagnostic	N
35006	CredUI_Dialog_DUIInitializeStart	Diagnostic	N
35007	CredUI_Dialog_DUIInitializeStop	Diagnostic	N
35008	CredUI_Dialog_LoadStyleSheetStart	Diagnostic	N
35009	CredUI_Dialog_LoadStyleSheetStop	Diagnostic	N
35010	CredUI_ModernDialog_CreatedStart	Diagnostic	N
35011	CredUI_ModernDialog_CreatedStop	Diagnostic	N
35012	CredUI_ModernDialog_DUIInitializeStart	Diagnostic	N
35013	CredUI_ModernDialog_DUIInitializeStop	Diagnostic	N
35014	CredUI_ModernDialog_LoadStyleSheetStart	Diagnostic	N
35015	CredUI_ModernDialog_LoadStyleSheetStop	Diagnostic	N
35016	CredUI_EnumerationSyncStop	Diagnostic	N
45001	Shutdown_ShutdownChoices_UserHasShutdownRightsStart	Diagnostic	N
45002	Shutdown_ShutdownChoices_UserHasShutdownRightsStop	Diagnostic	N
45003	Shutdown_ShutdownFlyout_CreateAndShowStart	Diagnostic	N
45004	Shutdown_ShutdownFlyout_CreateAndShowStop	Diagnostic	N
45005	Shutdown_ShutdownFlyout_PromptForReasonStart	Diagnostic	N
45006	Shutdown_ShutdownFlyout_PromptForReasonStop	Diagnostic	N
45007	Shutdown_ShutdownFlyout_PromptForConfirmationStart	Diagnostic	N
45008	Shutdown_ShutdownFlyout_PromptForConfirmationStop	Diagnostic	N
45009	Shutdown_ShutdownFlyout_InitiatePowerTransitionStart	Diagnostic	N
45010	Shutdown_ShutdownFlyout_InitiatePowerTransitionStop	Diagnostic	N
45011	Shutdown_SlideToShutDownScreen_InitializeStart	Diagnostic	N
45012	Shutdown_SlideToShutDownScreen_InitializeStop	Diagnostic	N
45013	Shutdown_SlideToShutDownScreen_ShowModalStart	Diagnostic	N
45014	Shutdown_SlideToShutDownScreen_ShowModalStop	Diagnostic	N
45015	Shutdown_SlideToShutDownScreen_SelfRevealAnimationStart	Diagnostic	N
45016	Shutdown_SlideToShutDownScreen_SelfRevealAnimationStop	Diagnostic	N
45017	Shutdown_SlideToShutDownScreen_DismissStart	Diagnostic	N
45018	Shutdown_SlideToShutDownScreen_DismissStop	Diagnostic	N
45019	Shutdown_SlideToShutDownScreen_Timeout	Diagnostic	N
55001	CredentialProviderUser_EnumerateLogonUsersStart	Diagnostic	N
55002	CredentialProviderUser_EnumerateLogonUsersStop	Diagnostic	N
55003	CredentialProviderUser_EnumerateLastLoggedOnUserStart	Diagnostic	N
55004	CredentialProviderUser_EnumerateLastLoggedOnUserStop	Diagnostic	N
55005	CredentialProviderUser_EnumerateAutoLogonUserStart	Diagnostic	N
55006	CredentialProviderUser_EnumerateAutoLogonUserStop	Diagnostic	N
55007	CredentialProviderUser_EnumerateInSessionUserStart	Diagnostic	N
55008	CredentialProviderUser_EnumerateInSessionUserStop	Diagnostic	N
55009	CredentialProviderUser_EnumerateLocalAdminsStart	Diagnostic	N
55010	CredentialProviderUser_EnumerateLocalAdminsStop	Diagnostic	N
55011	CredentialProviderUser_Init_CredentialProviderUserArrayStart	Diagnostic	N
55012	CredentialProviderUser_Init_CredentialProviderUserArrayStop	Diagnostic	N
55013	CredentialProviderUser_CloneUserArray	Diagnostic	N
55014	CredentialProviderUser_SetProviderFilter	Diagnostic	N
55015	CredentialProviderUser_GetAccountOptions	Diagnostic	N
61001	PicturePassword_LaunchEnrollmentUX	Diagnostic	N
61002	PicturePassword_EnrollmentUXTeachingShown	Diagnostic	N
61003	PicturePassword_EnrollmentUXImageConfirmationShown	Diagnostic	N
61004	PicturePassword_EnrollmentUXRelearnShown	Diagnostic	N
61005	PicturePassword_EnrollmentUXGestureEntryShown	Diagnostic	N
61006	PicturePassword_EnrollmentUXGestureConfirmationShown	Diagnostic	N
61007	PicturePassword_EnrollmentUXEnrollmentConfirmationShown	Diagnostic	N
61008	PicturePassword_EnrollmentUXErrorShown	Diagnostic	N
61009	PicturePassword_RenderFeedbackStart	Diagnostic	N
61010	PicturePassword_RenderFeedbackStop	Diagnostic	N
61011	PicturePassword_FeedbackVisibleStart	Diagnostic	N
61012	PicturePassword_FeedbackVisibleStop	Diagnostic	N
61013	PicturePassword_SubmitEnrollmentToSystemStart	Diagnostic	N
61014	PicturePassword_SubmitEnrollmentToSystemStop	Diagnostic	N
61015	PicturePassword_SanitizeImageStart	Diagnostic	N
61016	PicturePassword_SanitizeImageStop	Diagnostic	N
61017	PicturePassword_EnrollmentHandlerCreate	Diagnostic	N
61018	PicturePassword_EnrollmentHandlerGetEnrollmentStatusStart	Diagnostic	N
61019	PicturePassword_EnrollmentHandlerGetEnrollmentStatusStop	Diagnostic	N
61020	PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStart	Diagnostic	N
61021	PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStop	Diagnostic	N
61022	PicturePassword_EnrollmentHandlerSetEnrollmentStart	Diagnostic	N
61023	PicturePassword_EnrollmentHandlerSetEnrollmentStop	Diagnostic	N
61024	PicturePassword_EnrollmentHandlerClearEnrollmentStart	Diagnostic	N
61025	PicturePassword_EnrollmentHandlerClearEnrollmentStop	Diagnostic	N
61026	PicturePassword_CredentialCreate	Diagnostic	N
61027	PicturePassword_CredentialSelected	Diagnostic	N
61028	PicturePassword_CredentialDeselected	Diagnostic	N
61029	PicturePassword_CredentialSetSubmitData	Diagnostic	N
61030	PicturePassword_CredentialGetSerializationStart	Diagnostic	N
61031	PicturePassword_CredentialGetSerializationStop	Diagnostic	N
61032	PicturePassword_SyncedImageLoadingStart	Diagnostic	N
61033	PicturePassword_SyncedImageLoadingStop	Diagnostic	N
61034	PicturePassword_EnrollmentImageSavingForRoamingStart	Diagnostic	N
61035	PicturePassword_EnrollmentImageSavingForRoamingStop	Diagnostic	N
61036	PicturePassword_SyncedImageSelected	Diagnostic	N
61037	PicturePassword_CheckRoamingImageAvailable	Diagnostic	N
64001	LockScreenCall_AcceptCallStart	Diagnostic	N
64002	LockScreenCall_AcceptCallStop	Diagnostic	N
64003	LockScreenCall_QueueCallStart	Diagnostic	N
64004	LockScreenCall_QueueCallStop	Diagnostic	N
64005	LockScreenCall_StartCallStart	Diagnostic	N
64006	LockScreenCall_StartCallStop	Diagnostic	N
64007	LockScreenCall_EndCallStart	Diagnostic	N
64008	LockScreenCall_EndCallStop	Diagnostic	N
64009	LockScreenCall_EvictCallStart	Diagnostic	N
64010	LockScreenCall_EvictCallStop	Diagnostic	N
64501	LockScreenCallBroker_StartCallStart	Diagnostic	N
64502	LockScreenCallBroker_StartCallStop	Diagnostic	N
64503	LockScreenCallBroker_EndCallStart	Diagnostic	N
64504	LockScreenCallBroker_EndCallStop	Diagnostic	N
64505	LockScreenCallBroker_OnUnlockingStart	Diagnostic	N
64506	LockScreenCallBroker_OnUnlockingStop	Diagnostic	N
64507	LockScreenCallBroker_EventSignaled	Diagnostic	N
64508	LockScreenCallBroker_HostExited	Diagnostic	N
64509	LockScreenCallBroker_AccessibleNameChanged	Diagnostic	N
64510	LockScreenCallBroker_AppExited	Diagnostic	N
65001	Booting_Animation_DoPearlSyncStart	Diagnostic	N
65002	Booting_Animation_DoPearlSyncStop	Diagnostic	N
65003	Booting_Animation_InitStart	Diagnostic	N
65004	Booting_Animation_InitStop	Diagnostic	N
65005	Booting_Animation_TimerProcStart	Diagnostic	N
65006	Booting_Animation_TimerProcStop	Diagnostic	N
65007	Booting_Animation_LoadImgStart	Diagnostic	N
65008	Booting_Animation_LoadImgStop	Diagnostic	N
65009	Booting_Animation_AnimationCompleteProcStart	Diagnostic	N
65010	Booting_Animation_AnimationCompleteProcStop	Diagnostic	N
65011	Booting_Animation_AnimCallbackObjLifetimeStart	Diagnostic	N
65012	Booting_Animation_AnimCallbackObjLifetimeStop	Diagnostic	N
65013	Booting_Animation_PlaySoundThreadStart	Diagnostic	N
65014	Booting_Animation_PlaySoundThreadStop	Diagnostic	N
65015	Booting_Animation_InitAudioThreadStart	Diagnostic	N
65016	Booting_Animation_InitAudioThreadStop	Diagnostic	N
65017	Booting_Animation_AttachToMMCSSStart	Diagnostic	N
65018	Booting_Animation_AttachToMMCSSStop	Diagnostic	N
65019	Logon_LogonFrame_InitializeInputIndicatorStart	Diagnostic	N
65020	Logon_LogonFrame_InitializeInputIndicatorStop	Diagnostic	N
65030	LockscreenNotifications_NotificationUpdatedStart	Diagnostic	N
65031	LockscreenNotifications_NotificationUpdatedStop	Diagnostic	N
65032	LockscreenNotifications_NotificationArrivedStart	Diagnostic	N
65033	LockscreenNotifications_NotificationArrivedStop	Diagnostic	N

Event ID 5001: Logon user interface creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface creation failed. Details: Error.

Message #

Logon user interface creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5002: Logon user interface RPC server startup failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Logon user interface RPC server startup failed. Details: Error.

Message #

Logon user interface RPC server startup failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5003: The username/password credential provider failed to enumerate tiles.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The username/password credential provider failed to enumerate tiles.

Message #

The username/password credential provider failed to enumerate tiles.

Event ID 5004: Autologon failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

Autologon failed. Details: Error.

Message #

Autologon failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5005: The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded.

Message #

The autologon password could not be loaded.

Event ID 5006: The autologon password could not be loaded.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon password could not be loaded. Details: Error.

Message #

The autologon password could not be loaded.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5007: The OEM background could not be loaded for resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background could not be loaded for resolution DWORD1 x DWORD2. Details: Error.

Message #

The OEM background could not be loaded for resolution %2 x %3.  Details: %1

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 5008: The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

Message #

The OEM background %1 was loaded but its aspect ratio does not match the primary display resolution %2 x %3.

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 5009: The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

Message #

The OEM background %1 was not loaded because the file is larger than %2 bytes.

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 5010: The credential provider thread creation failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The credential provider thread creation failed. Details: Error.

Message #

The credential provider thread creation failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5011: User enumeration failed.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

User enumeration failed. Details: Error.

Message #

User enumeration failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5012: The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

Message #

The first run task for package %1 exceeded the maximum runtime alotted and has been cancelled.

Fields #

Name	Description
`PackageFullName` UnicodeString

Event ID 5013: The autologon setting has been removed because AutoLogonSettingRemovalReason.

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Operational
Opcode: Info

Description

The autologon setting has been removed because AutoLogonSettingRemovalReason.

Message #

The autologon setting has been removed because %1.

Fields #

Name	Description
`AutoLogonSettingRemovalReason` UInt32

Event ID 15001: Common_UserList_TileEnumerationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Start

Event ID 15002: Common_UserList_TileEnumerationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_UserList_TileEnumeration
Opcode: Stop

Event ID 15003: Common_GetMachineNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Start

Event ID 15004: Common_GetMachineNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineName
Opcode: Stop

Event ID 15005: Common_GetMachineDomainNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Start

Event ID 15006: Common_GetMachineDomainNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetMachineDomainName
Opcode: Stop

Event ID 15007: Common_GetBuiltInAdministratorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Start

Event ID 15008: Common_GetBuiltInAdministratorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetBuiltInAdministrator
Opcode: Stop

Event ID 15009: Common_GetInSessionUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Start

Event ID 15010: Common_GetInSessionUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetInSessionUser
Opcode: Stop

Event ID 15011: Common_GetFriendlyNameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Start

Event ID 15012: Common_GetFriendlyNameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFriendlyName
Opcode: Stop

Event ID 15013: Common_Tile_FireSubmitEvent

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Tile_FireSubmitEvent

Event ID 15014: Common_CreateCredentialProvidersStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Start

Event ID 15015: Common_CreateCredentialProvidersStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredentialProviders
Opcode: Stop

Event ID 15016: Common_AddCredProvider

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_AddCredProvider

Fields #

Name	Description
`message1` UnicodeString

Event ID 15017: Common_CreateCredProviderThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Start

Event ID 15018: Common_CreateCredProviderThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateCredProviderThread
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15019: Common_CredProviderThreadProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Start

Event ID 15020: Common_CredProviderThreadProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadProc
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15021: Common_CredProviderThreadDestroyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Start

Event ID 15022: Common_CredProviderThreadDestroyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CredProviderThreadDestroy
Opcode: Stop

Event ID 15023: Common_SetUsageScenario

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetUsageScenario

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32

Event ID 15024: Common_SetSerialization

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSerialization

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 15025: Common_GetCredentialAt

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialAt

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15026: Common_GetCredentialCount

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetCredentialCount

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32
`DWORD2` UInt32
`Boolean1` Boolean

Event ID 15027: Common_GetFieldDescriptorCount

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetFieldDescriptorCount

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15028: Common_Credential_GetUserSid

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_Credential_GetUserSid

Fields #

Name	Description
`DWORD1` UInt32
`message1` UnicodeString
`message2` UnicodeString

Event ID 15029: Common_SetSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetSelected

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15030: Common_SetDeSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_SetDeSelected

Fields #

Name	Description
`DWORD1` UInt32

Event ID 15031: Common_GetSerialization

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_GetSerialization

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 15032: Common_ReportResult

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_ReportResult

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32
`DWORD3` UInt32

Event ID 15033: Common_RegisterEnumerationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Start

Event ID 15034: Common_RegisterEnumerationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_RegisterEnumeration
Opcode: Stop

Event ID 15035: Common_CreateEnumerationSyncReply

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_CreateEnumerationSyncReply

Event ID 15036: Common_StartCredProvsForUsageScenario

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Common_StartCredProvsForUsageScenario

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32

Event ID 25001: Logon_ServerCallback_AbortStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Start

Event ID 25002: Logon_ServerCallback_AbortStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Abort
Opcode: Stop

Event ID 25003: Logon_ServerCallback_DisplayLockedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Start

Event ID 25004: Logon_ServerCallback_DisplayLockedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayLocked
Opcode: Stop

Event ID 25005: Logon_ServerCallback_DisplayMessageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Start

Event ID 25006: Logon_ServerCallback_DisplayMessageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayMessage
Opcode: Stop

Event ID 25007: Logon_ServerCallback_DisplayRequestCredentialsErrorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Start

Event ID 25008: Logon_ServerCallback_DisplayRequestCredentialsErrorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayRequestCredentialsError
Opcode: Stop

Event ID 25009: Logon_ServerCallback_DisplaySecurityOptionsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Start

Event ID 25010: Logon_ServerCallback_DisplaySecurityOptionsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplaySecurityOptions
Opcode: Stop

Event ID 25011: Logon_ServerCallback_DisplayStatusStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Start

Event ID 25012: Logon_ServerCallback_DisplayStatusStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayStatus
Opcode: Stop

Event ID 25013: Logon_ServerCallback_DisplayWelcomeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Start

Event ID 25014: Logon_ServerCallback_DisplayWelcomeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_DisplayWelcome
Opcode: Stop

Event ID 25015: Logon_ServerCallback_ReportResultStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Start

Event ID 25016: Logon_ServerCallback_ReportResultStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_ReportResult
Opcode: Stop

Event ID 25017: Logon_ServerCallback_RequestCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Start

Event ID 25018: Logon_ServerCallback_RequestCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_RequestCredentials
Opcode: Stop

Event ID 25019: Logon_ServerCallback_ShutdownStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Start

Event ID 25020: Logon_ServerCallback_ShutdownStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_Shutdown
Opcode: Stop

Event ID 25021: Logon_ServerCallback_PromptForCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Start

Event ID 25022: Logon_ServerCallback_PromptForCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerCallback_PromptForCredentials
Opcode: Stop

Event ID 25023: Logon_LogonFrame_OnSwitchUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Start

Event ID 25024: Logon_LogonFrame_OnSwitchUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSwitchUser
Opcode: Stop

Event ID 25025: Logon_LogonFrame_OnOtherTilesStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Start

Event ID 25026: Logon_LogonFrame_OnOtherTilesStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnOtherTiles
Opcode: Stop

Event ID 25027: Logon_LogonFrame_OnGetEnumeratedTilesReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Start

Event ID 25028: Logon_LogonFrame_OnGetEnumeratedTilesReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode: Stop

Event ID 25029: Logon_LogonFrame_OnEnumerationSyncReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Start

Event ID 25030: Logon_LogonFrame_OnEnumerationSyncReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnEnumerationSyncReply
Opcode: Stop

Event ID 25031: Logon_LogonFrame_OnSelectCredentialReplyStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Start

Event ID 25032: Logon_LogonFrame_OnSelectCredentialReplyStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnSelectCredentialReply
Opcode: Stop

Event ID 25033: Logon_LogonFrame_SetBackgroundGraphicsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Start

Event ID 25034: Logon_LogonFrame_SetBackgroundGraphicsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_SetBackgroundGraphics
Opcode: Stop

Event ID 25035: Logon_LogonFrame_InitializeFrameStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Start

Event ID 25036: Logon_LogonFrame_InitializeFrameStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeFrame
Opcode: Stop

Event ID 25037: Logon_LogonFrame_CreateStyleParserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Start

Event ID 25038: Logon_LogonFrame_CreateStyleParserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateStyleParser
Opcode: Stop

Event ID 25039: Logon_LogonFrame_CreateFrameElementStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Start

Event ID 25040: Logon_LogonFrame_CreateFrameElementStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_CreateFrameElement
Opcode: Stop

Event ID 25041: Logon_LogonFrame_InitializeUserListsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Start

Event ID 25042: Logon_LogonFrame_InitializeUserListsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeUserLists
Opcode: Stop

Event ID 25043: Logon_LogonFrame_BrandingLoadImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Start

Event ID 25044: Logon_LogonFrame_BrandingLoadImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_BrandingLoadImage
Opcode: Stop

Event ID 25047: Logon_LogonFrame_InitializeSoftKeyboardStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Start

Event ID 25048: Logon_LogonFrame_InitializeSoftKeyboardStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeSoftKeyboard
Opcode: Stop

Event ID 25049: Logon_LogonFrame_WTSRegisterSessionNotificationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Start

Event ID 25050: Logon_LogonFrame_WTSRegisterSessionNotificationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_WTSRegisterSessionNotification
Opcode: Stop

Event ID 25051: Logon_AutoLogon_IsSingleUserNoPasswordStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Start

Event ID 25052: Logon_AutoLogon_IsSingleUserNoPasswordStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Fields #

Name	Description
`Boolean1` Boolean

Event ID 25053: Logon_AutoLogon_IsLocalNoPasswordUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsLocalNoPasswordUser
Opcode: Start

Event ID 25054: Logon_AutoLogon_IsSingleUserNoPasswordStop25054

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IsSingleUserNoPassword
Opcode: Stop

Event ID 25055: Logon_ServerStartupStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Start

Event ID 25056: Logon_ServerStartupStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_ServerStartup
Opcode: Stop

Event ID 25057: Logon_LaunchToReadyForInputStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Start

Event ID 25058: Logon_LaunchToReadyForInputStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToReadyForInput
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32

Event ID 25059: Logon_CredentialsToExitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Start

Event ID 25060: Logon_CredentialsToExitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_CredentialsToExit
Opcode: Stop

Event ID 25061: Logon_RequestCredentialsToReadyForCredentialsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Start

Event ID 25062: Logon_RequestCredentialsToReadyForCredentialsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToReadyForCredentials
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32

Event ID 25063: Logon_LaunchToAnimationCompleteStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Start

Event ID 25064: Logon_LaunchToAnimationCompleteStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToAnimationComplete
Opcode: Stop

Event ID 25065: LogonUI_PerfTrack_UserSwitchingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_UserSwitching
Opcode: Stop

Event ID 25066: Logon_RequestCredentialsToCancelAfterEnumerateStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_RequestCredentialsToCancelAfterEnumerate
Opcode: Stop

Fields #

Name	Description
`CredProvUsageScenario` UInt32

Event ID 25068: Logon_LaunchToCancelAfterResumeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LaunchToCancelAfterResume
Opcode: Stop

Fields #

Name	Description
`ReadyForInputScenario` UInt32

Event ID 25072: LogonUI_SubmitCredentialToExitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Start

Event ID 25073: LogonUI_SubmitCredentialToExitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Fields #

Name	Description
`UserType` UInt32
`CredProvCount` UInt32
`IsLogonScenario` UInt32
`IsFirstLogon` UInt32

Event ID 25074: Logon_LogonFrame_OnGetSerializationReply

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnGetSerializationReply

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25075: Logon_LogonFrame_OnProviderCredentialsChanged

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_OnProviderCredentialsChanged

Fields #

Name	Description
`Boolean1` Boolean

Event ID 25076: Logon_LogonFrame_DisplayStatusMessage

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayStatusMessage

Fields #

Name	Description
`message1` UnicodeString

Event ID 25077: Logon_LogonFrame_LogonDialogCallback

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_LogonDialogCallback

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25078: Logon_LogonFrame_DisplayLogonDialog

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_DisplayLogonDialog

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25079: Logon_Background_GetBackgroundForUser

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_GetBackgroundForUser

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25080: Logon_Background_ShowUserBackground

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_Background_ShowUserBackground

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25082: Logon_AccessPage_LoadBackgroundImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Start

Event ID 25083: Logon_AccessPage_LoadBackgroundImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_LoadBackgroundImage
Opcode: Stop

Event ID 25084: Logon_AutoLogon_QueryAutoLogon_Info

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_QueryAutoLogon_Info

Fields #

Name	Description
`DWORD1` UInt32
`DWORD2` UInt32
`DWORD3` UInt32
`DWORD4` UInt32
`DWORD5` UInt32

Event ID 25085: Logon_AutoLogon_IgnoreAutoLogonMode_Info

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AutoLogon_IgnoreAutoLogonMode_Info

Event ID 25087: Logon_BSDR_InitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Start

Event ID 25088: Logon_BSDR_InitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Initialize
Opcode: Stop

Event ID 25089: Logon_BSDR_Shown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_Shown

Event ID 25090: Logon_BSDR_AddApplicationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`DWORD1` UInt32

Event ID 25091: Logon_BSDR_AddApplicationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_AddApplication
Opcode: Stop

Event ID 25093: Logon_BSDR_RemoveApplicationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Start

Fields #

Name	Description
`DWORD1` UInt32

Event ID 25094: Logon_BSDR_RemoveApplicationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BSDR_RemoveApplication
Opcode: Stop

Event ID 25095: LogonUI_SubmitCredentialToExitStop25095

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_SubmitCredentialToExit
Opcode: Stop

Event ID 25096: LogonUI_PerfTrack_LockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LogonUI_PerfTrack_Lock
Opcode: Stop

Event ID 25097: Logon_LanguageProfile_SwitchInputMethodsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Start

Event ID 25098: Logon_LanguageProfile_SwitchInputMethodsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LanguageProfile_SwitchInputMethods
Opcode: Stop

Event ID 25099: Logon_AccessPage_CancelFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Start

Event ID 25100: Logon_AccessPage_CancelFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks
Opcode: Stop

Fields #

Name	Description
`OutstandingTasks` UInt32
`TasksCancelled` UInt32

Event ID 25101: Logon_AccessPage_CancelFirstRunTasks

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_CancelFirstRunTasks

Fields #

Name	Description
`PackageFullName` UnicodeString

Event ID 25102: Logon_AccessPage_TriggerFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Start

Event ID 25103: Logon_AccessPage_TriggerFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_TriggerFirstRunTasks
Opcode: Stop

Event ID 25104: Logon_AccessPage_WaitForFirstRunTasksStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Start

Event ID 25105: Logon_AccessPage_WaitForFirstRunTasksStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_WaitForFirstRunTasks
Opcode: Stop

Event ID 25106: Logon_BackButtonNotificationFlyoutStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Start

Event ID 25107: Logon_BackButtonNotificationFlyoutStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_BackButtonNotificationFlyout
Opcode: Stop

Event ID 25108: Logon_AccessPage_UnlockStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Start

Event ID 25109: Logon_AccessPage_UnlockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Unlock
Opcode: Stop

Event ID 25110: Logon_AccessPage_LockStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Start

Event ID 25111: Logon_AccessPage_LockStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock
Opcode: Stop

Event ID 25112: Logon_AccessPage_Lock

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Lock

Event ID 25113: Logon_AccessPage_Camera_ControlCreationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Start

Fields #

Name	Description
`InvokeObject` UInt32

Event ID 25114: Logon_AccessPage_Camera_ControlCreationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ControlCreation
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 25115: Logon_AccessPage_Camera_ViewfinderInitializationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Start

Event ID 25116: Logon_AccessPage_Camera_ViewfinderInitializationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ViewfinderInitialization
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 25117: Logon_AccessPage_Camera_ActiveDurationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Start

Event ID 25118: Logon_AccessPage_Camera_ActiveDurationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ActiveDuration
Opcode: Stop

Event ID 25119: Logon_AccessPage_Camera_ShutdownDurationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Start

Event ID 25120: Logon_AccessPage_Camera_ShutdownDurationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_AccessPage_Camera_ShutdownDuration
Opcode: Stop

Event ID 35001: CredUI_Prompt_Called

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Prompt_Called

Event ID 35002: CredUI_Dialog_CreatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Start

Event ID 35003: CredUI_Dialog_CreatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Created
Opcode: Stop

Event ID 35004: CredUI_UserList_TileEnumeration

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_UserList_TileEnumeration

Event ID 35005: CredUI_Dialog_Destroyed

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_Destroyed

Event ID 35006: CredUI_Dialog_DUIInitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Start

Event ID 35007: CredUI_Dialog_DUIInitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_DUIInitialize
Opcode: Stop

Event ID 35008: CredUI_Dialog_LoadStyleSheetStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Start

Event ID 35009: CredUI_Dialog_LoadStyleSheetStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_Dialog_LoadStyleSheet
Opcode: Stop

Event ID 35010: CredUI_ModernDialog_CreatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Start

Event ID 35011: CredUI_ModernDialog_CreatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_Created
Opcode: Stop

Event ID 35012: CredUI_ModernDialog_DUIInitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Start

Event ID 35013: CredUI_ModernDialog_DUIInitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_DUIInitialize
Opcode: Stop

Event ID 35014: CredUI_ModernDialog_LoadStyleSheetStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Start

Event ID 35015: CredUI_ModernDialog_LoadStyleSheetStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_ModernDialog_LoadStyleSheet
Opcode: Stop

Event ID 35016: CredUI_EnumerationSyncStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredUI_EnumerationSync
Opcode: Stop

Event ID 45001: Shutdown_ShutdownChoices_UserHasShutdownRightsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Start

Event ID 45002: Shutdown_ShutdownChoices_UserHasShutdownRightsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode: Stop

Event ID 45003: Shutdown_ShutdownFlyout_CreateAndShowStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Start

Event ID 45004: Shutdown_ShutdownFlyout_CreateAndShowStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_CreateAndShow
Opcode: Stop

Event ID 45005: Shutdown_ShutdownFlyout_PromptForReasonStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Start

Event ID 45006: Shutdown_ShutdownFlyout_PromptForReasonStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForReason
Opcode: Stop

Event ID 45007: Shutdown_ShutdownFlyout_PromptForConfirmationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Start

Event ID 45008: Shutdown_ShutdownFlyout_PromptForConfirmationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode: Stop

Event ID 45009: Shutdown_ShutdownFlyout_InitiatePowerTransitionStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Start

Event ID 45010: Shutdown_ShutdownFlyout_InitiatePowerTransitionStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode: Stop

Event ID 45011: Shutdown_SlideToShutDownScreen_InitializeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Start

Event ID 45012: Shutdown_SlideToShutDownScreen_InitializeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Initialize
Opcode: Stop

Event ID 45013: Shutdown_SlideToShutDownScreen_ShowModalStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Start

Fields #

Name	Description
`Boolean1` Boolean

Event ID 45014: Shutdown_SlideToShutDownScreen_ShowModalStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_ShowModal
Opcode: Stop

Event ID 45015: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Start

Event ID 45016: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode: Stop

Event ID 45017: Shutdown_SlideToShutDownScreen_DismissStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Start

Event ID 45018: Shutdown_SlideToShutDownScreen_DismissStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Dismiss
Opcode: Stop

Event ID 45019: Shutdown_SlideToShutDownScreen_Timeout

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Shutdown_SlideToShutDownScreen_Timeout

Event ID 55001: CredentialProviderUser_EnumerateLogonUsersStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Start

Event ID 55002: CredentialProviderUser_EnumerateLogonUsersStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLogonUsers
Opcode: Stop

Event ID 55003: CredentialProviderUser_EnumerateLastLoggedOnUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Start

Event ID 55004: CredentialProviderUser_EnumerateLastLoggedOnUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode: Stop

Event ID 55005: CredentialProviderUser_EnumerateAutoLogonUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Start

Event ID 55006: CredentialProviderUser_EnumerateAutoLogonUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateAutoLogonUser
Opcode: Stop

Event ID 55007: CredentialProviderUser_EnumerateInSessionUserStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Start

Event ID 55008: CredentialProviderUser_EnumerateInSessionUserStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateInSessionUser
Opcode: Stop

Event ID 55009: CredentialProviderUser_EnumerateLocalAdminsStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Start

Event ID 55010: CredentialProviderUser_EnumerateLocalAdminsStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_EnumerateLocalAdmins
Opcode: Stop

Event ID 55011: CredentialProviderUser_Init_CredentialProviderUserArrayStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Start

Event ID 55012: CredentialProviderUser_Init_CredentialProviderUserArrayStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_Init_CredentialProviderUserArray
Opcode: Stop

Event ID 55013: CredentialProviderUser_CloneUserArray

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_CloneUserArray

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 55014: CredentialProviderUser_SetProviderFilter

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_SetProviderFilter

Fields #

Name	Description
`Error` UnicodeString
`DWORD1` UInt32

Event ID 55015: CredentialProviderUser_GetAccountOptions

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: CredentialProviderUser_GetAccountOptions

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61001: PicturePassword_LaunchEnrollmentUX

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_LaunchEnrollmentUX

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61002: PicturePassword_EnrollmentUXTeachingShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXTeachingShown

Event ID 61003: PicturePassword_EnrollmentUXImageConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXImageConfirmationShown

Event ID 61004: PicturePassword_EnrollmentUXRelearnShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXRelearnShown

Event ID 61005: PicturePassword_EnrollmentUXGestureEntryShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureEntryShown

Event ID 61006: PicturePassword_EnrollmentUXGestureConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXGestureConfirmationShown

Event ID 61007: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Event ID 61008: PicturePassword_EnrollmentUXErrorShown

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentUXErrorShown

Event ID 61009: PicturePassword_RenderFeedbackStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Start

Event ID 61010: PicturePassword_RenderFeedbackStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_RenderFeedback
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61011: PicturePassword_FeedbackVisibleStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Start

Event ID 61012: PicturePassword_FeedbackVisibleStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_FeedbackVisible
Opcode: Stop

Event ID 61013: PicturePassword_SubmitEnrollmentToSystemStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Start

Event ID 61014: PicturePassword_SubmitEnrollmentToSystemStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SubmitEnrollmentToSystem
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61015: PicturePassword_SanitizeImageStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Start

Event ID 61016: PicturePassword_SanitizeImageStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SanitizeImage
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61017: PicturePassword_EnrollmentHandlerCreate

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerCreate

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61018: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Start

Event ID 61019: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61020: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Start

Event ID 61021: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61022: PicturePassword_EnrollmentHandlerSetEnrollmentStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Start

Event ID 61023: PicturePassword_EnrollmentHandlerSetEnrollmentStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerSetEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61024: PicturePassword_EnrollmentHandlerClearEnrollmentStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Start

Event ID 61025: PicturePassword_EnrollmentHandlerClearEnrollmentStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentHandlerClearEnrollment
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61026: PicturePassword_CredentialCreate

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialCreate

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61027: PicturePassword_CredentialSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSelected

Event ID 61028: PicturePassword_CredentialDeselected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialDeselected

Event ID 61029: PicturePassword_CredentialSetSubmitData

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialSetSubmitData

Event ID 61030: PicturePassword_CredentialGetSerializationStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Start

Event ID 61031: PicturePassword_CredentialGetSerializationStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CredentialGetSerialization
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61032: PicturePassword_SyncedImageLoadingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Start

Event ID 61033: PicturePassword_SyncedImageLoadingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageLoading
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61034: PicturePassword_EnrollmentImageSavingForRoamingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Start

Event ID 61035: PicturePassword_EnrollmentImageSavingForRoamingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_EnrollmentImageSavingForRoaming
Opcode: Stop

Fields #

Name	Description
`DWORD1` UInt32

Event ID 61036: PicturePassword_SyncedImageSelected

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_SyncedImageSelected

Event ID 61037: PicturePassword_CheckRoamingImageAvailable

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: PicturePassword_CheckRoamingImageAvailable

Fields #

Name	Description
`DWORD1` UInt32

Event ID 64001: LockScreenCall_AcceptCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64002: LockScreenCall_AcceptCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_AcceptCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64003: LockScreenCall_QueueCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64004: LockScreenCall_QueueCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_QueueCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64005: LockScreenCall_StartCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID
`message1` UnicodeString
`message2` UnicodeString

Event ID 64006: LockScreenCall_StartCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64007: LockScreenCall_EndCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64008: LockScreenCall_EndCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64009: LockScreenCall_EvictCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64010: LockScreenCall_EvictCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCall_EvictCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64501: LockScreenCallBroker_StartCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Start

Fields #

Name	Description
`guid` GUID
`message1` UnicodeString
`message2` UnicodeString

Event ID 64502: LockScreenCallBroker_StartCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_StartCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64503: LockScreenCallBroker_EndCallStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 64504: LockScreenCallBroker_EndCallStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EndCall
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64505: LockScreenCallBroker_OnUnlockingStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Start

Fields #

Name	Description
`message1` UnicodeString
`message2` UnicodeString

Event ID 64506: LockScreenCallBroker_OnUnlockingStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_OnUnlocking
Opcode: Stop

Fields #

Name	Description
`HRESULT` UInt32

Event ID 64507: LockScreenCallBroker_EventSignaled

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_EventSignaled

Fields #

Name	Description
`guid` GUID

Event ID 64508: LockScreenCallBroker_HostExited

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_HostExited

Fields #

Name	Description
`guid` GUID

Event ID 64509: LockScreenCallBroker_AccessibleNameChanged

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AccessibleNameChanged

Fields #

Name	Description
`guid` GUID
`message` UnicodeString

Event ID 64510: LockScreenCallBroker_AppExited

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockScreenCallBroker_AppExited

Fields #

Name	Description
`guid` GUID

Event ID 65001: Booting_Animation_DoPearlSyncStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Start

Event ID 65002: Booting_Animation_DoPearlSyncStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_DoPearlSync
Opcode: Stop

Event ID 65003: Booting_Animation_InitStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Start

Event ID 65004: Booting_Animation_InitStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_Init
Opcode: Stop

Event ID 65005: Booting_Animation_TimerProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Start

Event ID 65006: Booting_Animation_TimerProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_TimerProc
Opcode: Stop

Event ID 65007: Booting_Animation_LoadImgStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Start

Event ID 65008: Booting_Animation_LoadImgStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_LoadImg
Opcode: Stop

Event ID 65009: Booting_Animation_AnimationCompleteProcStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Start

Event ID 65010: Booting_Animation_AnimationCompleteProcStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimationCompleteProc
Opcode: Stop

Event ID 65011: Booting_Animation_AnimCallbackObjLifetimeStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Start

Event ID 65012: Booting_Animation_AnimCallbackObjLifetimeStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AnimCallbackObjLifetime
Opcode: Stop

Event ID 65013: Booting_Animation_PlaySoundThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Start

Event ID 65014: Booting_Animation_PlaySoundThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_PlaySoundThread
Opcode: Stop

Event ID 65015: Booting_Animation_InitAudioThreadStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Start

Event ID 65016: Booting_Animation_InitAudioThreadStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_InitAudioThread
Opcode: Stop

Event ID 65017: Booting_Animation_AttachToMMCSSStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Start

Event ID 65018: Booting_Animation_AttachToMMCSSStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Booting_Animation_AttachToMMCSS
Opcode: Stop

Event ID 65019: Logon_LogonFrame_InitializeInputIndicatorStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Start

Event ID 65020: Logon_LogonFrame_InitializeInputIndicatorStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: Logon_LogonFrame_InitializeInputIndicator
Opcode: Stop

Event ID 65030: LockscreenNotifications_NotificationUpdatedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString

Event ID 65031: LockscreenNotifications_NotificationUpdatedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationUpdated
Opcode: Stop

Event ID 65032: LockscreenNotifications_NotificationArrivedStart

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Start

Fields #

Name	Description
`NotificationType` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`AppId` UnicodeString

Event ID 65033: LockscreenNotifications_NotificationArrivedStop

Provider: Microsoft-Windows-Shell-AuthUI
Channel: Diagnostic
Task: LockscreenNotifications_NotificationArrived
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 63d2bb1d-e39a-41b8-9a3d-52dd06677588

Defined in credprovhost.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)