Microsoft-Windows-SmartCard-DeviceEnum

Event	Title	Channel	Sample	Rule
99	Creation of node InstancePath failed with ErrorCode.	Operational	N	N
100	Removal of node InstancePath failed with ErrorCode.	Operational	N	N
101	Created node InstancePath on session SessionId.	Operational	Y	N
102	Removed node InstancePath on session SessionId.	Operational	N	N
103	ScDeviceEnum service started.	Operational	Y	N
104	ScDeviceEnum service stopped.	Operational	N	N

Event ID 99: Creation of node InstancePath failed with ErrorCode.

Channel: Operational

Message #

Creation of node %1 failed with %2.

Fields #

Name	Description
`InstancePath` UnicodeString
`ErrorCode` Int32

Event ID 100: Removal of node InstancePath failed with ErrorCode.

Channel: Operational

Message #

Removal of node %1 failed with %2.

Fields #

Name	Description
`InstancePath` UnicodeString
`ErrorCode` Int32

Event ID 101: Created node InstancePath on session SessionId.

Channel: Operational
Level: Informational

Message #

Created node %1 on session %2.

Fields #

Name	Description
`InstancePath` UnicodeString
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SmartCard-DeviceEnum",
    "event_id": 101,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T02:09:23.1653236+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "Microsoft-Windows-SmartCard-DeviceEnum"
  },
  "event_data": {
    "SessionId": "0",
    "InstancePath": "SWD\\ScDeviceEnumBus\\1"
  }
}

Event ID 102: Removed node InstancePath on session SessionId.

Channel: Operational

Message #

Removed node %1 on session %2.

Fields #

Name	Description
`InstancePath` UnicodeString
`SessionId` UInt32

Event ID 103: ScDeviceEnum service started.

Channel: Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SmartCard-DeviceEnum",
    "event_id": 103,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T02:09:23.1750281+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "Microsoft-Windows-SmartCard-DeviceEnum"
  },
  "event_data": {}
}

Event ID 104: ScDeviceEnum service stopped.

Channel: Operational

Provenance

ETW provider GUID aaeac398-3028-487c-9586-44eacad03637

Defined in ScDeviceEnum.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3323, captured 2026-06-02 — Manifest XML pack, 2.0 MB