detection.wiki

Microsoft-Windows-SmartCard-Audit

EventTitleChannelSampleRule
100A smart card holder verification (CHV) attempt failed.AuthenticationNN
101A smart card holder verification (CHV) attempt succeeded.AuthenticationNN

Event ID 100: A smart card holder verification (CHV) attempt failed.

#
Channel
Authentication
Task
Failure

Message #

A smart card holder verification (CHV) attempt failed.

Process image: %1
PID: %2

Fields #

NameDescription
Process UnicodeString
ProcessId UInt32

Event ID 101: A smart card holder verification (CHV) attempt succeeded.

#
Channel
Authentication
Task
Success

Message #

A smart card holder verification (CHV) attempt succeeded.

Process image: %1
PID: %2

Fields #

NameDescription
Process UnicodeString
ProcessId UInt32

Provenance

ETW provider GUID 09ac07b9-6ac9-43bc-a50f-58419a797c69

Defined in WinSCard.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3323, captured 2026-06-02 — Manifest XML pack, 2.0 MB