Microsoft-Windows-SmartCard-TPM-VCard-Module

11 events across 2 channels

Event	Title	Channel	Sample
1101	TPM Virtual Smart Card failed to verify TPM state.	Admin	N
1102	TPM Virtual Smart Card failed to verify TPM state.	Admin	N
1103	TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout …	Admin	N
1104	TPM Virtual Smart Card failed to verify TPM state.	Admin	N
2101	TPM Virtual Smart Card is loading.	Operational	N
2102	TPM Virtual Smart Card has been loaded.	Operational	N
2103	TPM Virtual Smart Card cannot be loaded with error: WinError.	Operational	N
2104	TPM Virtual Smart Card is verifying TPM state.	Operational	N
2105	TPM Virtual Smart Card has successfully verified TPM state.	Operational	N
2106	TPM Virtual Smart Card is closing.	Operational	N
2107	TPM Virtual Smart Card has been closed.	Operational	N

Event ID 1101: TPM Virtual Smart Card failed to verify TPM state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. TPM is not ready for this TPM Virtual Smart Card.

Message #

TPM Virtual Smart Card failed to verify TPM state. TPM is not ready for this TPM Virtual Smart Card.

Card root path: %1
TPM verification failed with error: %2

Fields #

Name	Description
`Path` UnicodeString
`WinError` UInt32

Event ID 1102: TPM Virtual Smart Card failed to verify TPM state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. Some of the TPM keys are missing. If the ownership of the TPM is recently changed, all previously created TPM Virtual Smart Cards will be invalidated. Card root path: Path

Message #

TPM Virtual Smart Card failed to verify TPM state. Some of the TPM keys are missing. If the ownership of the TPM is recently changed, all previously created TPM Virtual Smart Cards will be invalidated.

 Card root path: %1

Fields #

Name	Description
`Path` UnicodeString

Event ID 1103: TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Admin

Description

TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Message #

TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Card root path: %1

Fields #

Name	Description
`Path` UnicodeString

Event ID 1104: TPM Virtual Smart Card failed to verify TPM state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. The Trusted Platform Module (TPM) firmware on this PC has a known security problem. Please contact your PC manufacturer to find out if an update is available.

Message #

TPM Virtual Smart Card failed to verify TPM state. The Trusted Platform Module (TPM) firmware on this PC has a known security problem. Please contact your PC manufacturer to find out if an update is available.

Fields #

Name	Description
`WinError` UInt32

Event ID 2101: TPM Virtual Smart Card is loading.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card is loading.

Message #

TPM Virtual Smart Card is loading.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2102: TPM Virtual Smart Card has been loaded.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card has been loaded.

Message #

TPM Virtual Smart Card has been loaded.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2103: TPM Virtual Smart Card cannot be loaded with error: WinError.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card cannot be loaded with error: WinError.

Message #

TPM Virtual Smart Card cannot be loaded with error: %2

Context: %1

Fields #

Name	Description
`Context` Pointer
`WinError` UInt32

Event ID 2104: TPM Virtual Smart Card is verifying TPM state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card is verifying TPM state.

Message #

TPM Virtual Smart Card is verifying TPM state.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2105: TPM Virtual Smart Card has successfully verified TPM state.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card has successfully verified TPM state.

Message #

TPM Virtual Smart Card has successfully verified TPM state.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2106: TPM Virtual Smart Card is closing.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card is closing.

Message #

TPM Virtual Smart Card is closing.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2107: TPM Virtual Smart Card has been closed.

Provider: Microsoft-Windows-SmartCard-TPM-VCard-Module
Channel: Operational

Description

TPM Virtual Smart Card has been closed.

Message #

TPM Virtual Smart Card has been closed.

Context: %1

Fields #

Name	Description
`Context` Pointer

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 125f2cf1-2768-4d33-976e-527137d080f8

Defined in tpmvsc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-SmartCard-TPM-VCard-Module

Event ID 1101: TPM Virtual Smart Card failed to verify TPM state.

Description

Message #

Fields #

Event ID 1102: TPM Virtual Smart Card failed to verify TPM state.

Description

Message #

Fields #

Event ID 1103: TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Description

Message #

Fields #

Event ID 1104: TPM Virtual Smart Card failed to verify TPM state.

Description

Message #

Fields #

Event ID 2101: TPM Virtual Smart Card is loading.

Description

Message #

Fields #

Event ID 2102: TPM Virtual Smart Card has been loaded.

Description

Message #

Fields #

Event ID 2103: TPM Virtual Smart Card cannot be loaded with error: WinError.

Description

Message #

Fields #

Event ID 2104: TPM Virtual Smart Card is verifying TPM state.

Description

Message #

Fields #

Event ID 2105: TPM Virtual Smart Card has successfully verified TPM state.

Description

Message #

Fields #

Event ID 2106: TPM Virtual Smart Card is closing.

Description

Message #

Fields #

Event ID 2107: TPM Virtual Smart Card has been closed.

Description

Message #

Fields #

Provenance

Downloads