Microsoft-Windows-WebAuthN

Event	Title	Channel	Sample	Rule
1000	WebAuthN Ctap MakeCredential started.	Operational	N	N
1001	WebAuthN Ctap MakeCredential completed.	Operational	N	N
1002	WebAuthN Ctap MakeCredential completed.	Operational	N	N
1003	WebAuthN Ctap GetAssertion started.	Operational	N	N
1004	WebAuthN Ctap GetAssertion completed.	Operational	N	N
1005	WebAuthN Ctap GetAssertion completed.	Operational	N	N
1006	WebAuthN Ctap SendCommand started.	Operational	N	N
1007	WebAuthN Ctap SendCommand completed.	Operational	N	N
1008	WebAuthN Ctap SendCommand completed.	Operational	N	N
1020	WebAuthN Ngc MakeCredential started.	Operational	N	N
1021	WebAuthN Ngc MakeCredential completed.	Operational	N	N
1022	WebAuthN Ngc MakeCredential completed.	Operational	N	N
1023	WebAuthN Ngc GetAssertion started.	Operational	N	N
1024	WebAuthN Ngc GetAssertion completed.	Operational	N	N
1025	WebAuthN Ngc GetAssertion completed.	Operational	N	N
1040	Ngc MakeCredential request.	Operational	N	N
1041	Ngc MakeCredential response.	Operational	N	N
1042	Ngc GetAssertion request.	Operational	N	N
1043	Ngc GetAssertion response.	Operational	N	N
1050	WebAuthN remote RPC request.	Operational	Y	N
1052	WebAuthN remote RPC response.	Operational	Y	N
1060	WebAuthN error at: Action.	Operational	N	N
1070	WebAuthN IsUserVerifyingPlatformAuthenticatorAvailale: value.	Operational	Y	N
1071	WebAuthN ApiVersion: value.	Operational	Y	N
1072	WebAuthN CancelCurrentOperation: value.	Operational	N	N
1100	Cbor decode error.	Operational	N	N
1101	Cbor encode MakeCredential request.	Operational	N	N
1102	Cbor decode MakeCredential response.	Operational	N	N
1103	Cbor encode GetAssertion request.	Operational	N	N
1104	Cbor decode GetAssertion response.	Operational	N	N
2000	Ctap service started successfully.	Operational	Y	N
2001	Ctap service stopped successfully.	Operational	Y	N
2100	Ctap Command started.	Operational	Y	N
2101	Ctap command started.	Operational	N	N
2102	Ctap Command completed.	Operational	Y	N
2103	Ctap Command completed.	Operational	N	N
2104	Ctap device info.	Operational	N	N
2105	Ctap Function: Function Location: Location.	Operational	N	N
2106	Ctap Name: Name Value: Value.	Operational	N	N
2107	Event ID 2107	Operational	N	N
2110	Ctap device device state info.	Operational	N	N
2111	Ctap device change notify info.	Operational	N	N
2200	Ctap Usb provider thread started.	Operational	N	N
2201	Ctap Usb provider thread completed.	Operational	N	N
2202	Ctap Usb provider thread completed.	Operational	N	N
2203	Ctap Usb provider thread completed.	Operational	N	N
2210	Ctap Usb device thread started.	Operational	N	N
2211	Ctap Usb device thread completed.	Operational	N	N
2212	Ctap Usb device thread completed.	Operational	N	N
2213	Ctap Usb device thread completed.	Operational	N	N
2220	Ctap Usb add device.	Operational	N	N
2221	Ctap Usb remove device.	Operational	N	N
2222	Ctap Usb device changes.	Operational	N	N
2223	Ctap Usb U2F device.	Operational	N	N
2224	Ctap Usb connect to device.	Operational	N	N
2225	Ctap Usb Send Receive.	Operational	N	N
2226	Ctap Usb Send Receive.	Operational	N	N
2250	Ctap Ble provider thread started.	Operational	N	N
2251	Ctap Ble provider thread completed.	Operational	N	N
2252	Ctap Ble provider thread completed.	Operational	N	N
2253	Ctap Ble provider thread completed.	Operational	N	N
2260	Ctap Ble device thread started.	Operational	N	N
2261	Ctap Ble device thread completed.	Operational	N	N
2262	Ctap Ble device thread completed.	Operational	N	N
2263	Ctap Ble device thread completed.	Operational	N	N
2270	Ctap Ble Function: Function Location: Location.	Operational	N	N
2271	Ctap Ble U2F device.	Operational	N	N
2272	Ctap Ble Send Receive.	Operational	N	N
2273	Ctap Ble Send Receive.	Operational	N	N
2300	Ctap Nfc provider thread started.	Operational	N	N
2301	Ctap Nfc provider thread completed.	Operational	N	N
2302	Ctap Nfc provider thread completed.	Operational	N	N
2303	Ctap Nfc provider thread completed.	Operational	N	N
2310	Ctap Nfc reader thread started.	Operational	N	N
2311	Ctap Nfc reader thread completed.	Operational	N	N
2312	Ctap Nfc reader thread completed.	Operational	N	N
2313	Ctap Nfc reader thread completed.	Operational	N	N
2314	Ctap Nfc reader manager thread started.	Operational	N	N
2315	Ctap Nfc reader manager thread completed.	Operational	N	N
2316	Cancelling Reader Threads.	Operational	N	N
2320	Ctap Nfc add reader.	Operational	N	N
2321	Ctap Nfc skip reader for: Action.	Operational	N	N
2322	Ctap Nfc transition reader for: Action.	Operational	N	N
2323	Ctap Nfc send message warning for: Action.	Operational	N	N
2324	Ctap Nfc send request error for: Action.	Operational	N	N
2325	Ctap Nfc U2F device.	Operational	N	N
2326	Ctap Nfc send message at: Action.	Operational	N	N
2327	Ctap Nfc SCardTransmit Request.	Operational	N	N
2328	Ctap Nfc SCardTransmit Request.	Operational	N	N
2329	Ctap Hybrid process Ctap command request callback started.	Operational	N	N
2330	Ctap Hybrid process Ctap command request callback completed.	Operational	N	N
2331	Ctap Hybrid process Ctap command request callback completed with error.	Operational	N	N
2332	Ctap Hybrid Write Message: Message.	Operational	N	N
2333	Ctap Hybrid Read Message: Message.	Operational	N	N
2334	Ctap Hybrid Protocol setup started.	Operational	N	N
2335	Ctap Hybrid Protocol setup completed.	Operational	N	N
2336	Ctap Hybrid Protocol setup completed with error.	Operational	N	N
2337	Ctap Hybrid Linked Device Saved.	Operational	N	N
2400	Ctap Test provider thread started.	Operational	N	N
2401	Ctap Test provider thread completed.	Operational	N	N
2402	Ctap Test provider thread completed.	Operational	N	N
5002	Trust group deletion synchronized	Operational, Operatonal	N	N
5009	User storage created	Operational, Operatonal	N	N
5010	Synchronization state:	Operational	N	N
5010	Synchronization state: SyncState.	Operatonal	N	N
6006	Trust group deleted	Operational, Operatonal	N	N
6007	Cleaned up Local Store	Operational, Operatonal	N	N
6011	This Windows device was not found in the Trusted Device list, resetting local …	Operational, Operatonal	N	N
6250	Event ID 6250	Operational	N	N
6251	Event ID 6251	Operational	N	N
6254	Event ID 6254	Operational	N	N
6254	Error when trying to decode a plugin passkey.	Operational	N	N
7000	Key rotation failed	Operational, Operatonal	N	N
7001	Cloud store operation failed	Operational, Operatonal	N	N
7003	Failed to add trusted device	Operational, Operatonal	N	N
7004	Failed to delete trusted device	Operational, Operatonal	N	N
7005	Failed to rename trusted device	Operational, Operatonal	N	N
7008	Local store operation failed	Operational, Operatonal	N	N
7251	Event ID 7251	Operational	N	N
7252	Event ID 7252	Operational	N	N
7253	Event ID 7253	Operational	N	N
7254	Event ID 7254	Operational	N	N
7255	Event ID 7255	Operational	N	N
8000	Key rotation succeeded	Operational, Operatonal	N	N
8001	Cloud store operation succeeded	Operational, Operatonal	N	N
8003	Trusted device successfully added	Operational, Operatonal	N	N
8004	Trusted device deleted successfully	Operational, Operatonal	N	N
8005	Trusted device renamed successfully	Operational, Operatonal	N	N
8008	Local store operation succeeded	Operational, Debug	N	N

Event ID 1000: WebAuthN Ctap MakeCredential started.

Channel: Operational
Task: WebAuthNCtapMakeCredential
Opcode: Start

Message #

WebAuthN Ctap MakeCredential started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1001: WebAuthN Ctap MakeCredential completed.

Channel: Operational
Task: WebAuthN Ctap MakeCredential
Opcode: Stop

Message #

WebAuthN Ctap MakeCredential completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1002: WebAuthN Ctap MakeCredential completed.

Channel: Operational
Task: WebAuthNCtapMakeCredential
Opcode: Stop

Message #

WebAuthN Ctap MakeCredential completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1003: WebAuthN Ctap GetAssertion started.

Channel: Operational
Task: WebAuthNCtapGetAssertion
Opcode: Start

Message #

WebAuthN Ctap GetAssertion started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1004: WebAuthN Ctap GetAssertion completed.

Channel: Operational
Task: WebAuthN Ctap GetAssertion
Opcode: Stop

Message #

WebAuthN Ctap GetAssertion completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1005: WebAuthN Ctap GetAssertion completed.

Channel: Operational
Task: WebAuthNCtapGetAssertion
Opcode: Stop

Message #

WebAuthN Ctap GetAssertion completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1006: WebAuthN Ctap SendCommand started.

Channel: Operational
Task: WebAuthNCtapSendCommand
Opcode: Start

Message #

WebAuthN Ctap SendCommand started.

TransactionId: %1
Ticket: %3

Fields #

Name	Description
`TransactionId` GUID
`TicketLength` UInt32
`Ticket` Binary

Event ID 1007: WebAuthN Ctap SendCommand completed.

Channel: Operational
Task: WebAuthN Ctap SendCommand
Opcode: Stop

Message #

WebAuthN Ctap SendCommand completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1008: WebAuthN Ctap SendCommand completed.

Channel: Operational
Task: WebAuthNCtapSendCommand
Opcode: Stop

Message #

WebAuthN Ctap SendCommand completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1020: WebAuthN Ngc MakeCredential started.

Channel: Operational
Task: WebAuthNNgcMakeCredential
Opcode: Start

Message #

WebAuthN Ngc MakeCredential started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1021: WebAuthN Ngc MakeCredential completed.

Channel: Operational
Task: WebAuthN Ngc MakeCredential
Opcode: Stop

Message #

WebAuthN Ngc MakeCredential completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1022: WebAuthN Ngc MakeCredential completed.

Channel: Operational
Task: WebAuthNNgcMakeCredential
Opcode: Stop

Message #

WebAuthN Ngc MakeCredential completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1023: WebAuthN Ngc GetAssertion started.

Channel: Operational
Task: WebAuthNNgcGetAssertion
Opcode: Start

Message #

WebAuthN Ngc GetAssertion started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1024: WebAuthN Ngc GetAssertion completed.

Channel: Operational
Task: WebAuthN Ngc GetAssertion
Opcode: Stop

Message #

WebAuthN Ngc GetAssertion completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 1025: WebAuthN Ngc GetAssertion completed.

Channel: Operational
Task: WebAuthNNgcGetAssertion
Opcode: Stop

Message #

WebAuthN Ngc GetAssertion completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1040: Ngc MakeCredential request.

Channel: Operational
Task: NgcMakeCredentialRequest
Opcode: Informational

Message #

Ngc MakeCredential request.

TransactionId: %1
RpId: %2
AccountId: %3
ClientDataHashAlgId: %4 ClientDataLength: %5 ClientDataHash: %7
ExcludeCredentialCount: %8
CredentialParameterCount: %9

Fields #

Name	Description
`TransactionId` GUID
`RpId` UnicodeString
`AccountId` UnicodeString
`ClientDataHashAlgId` UnicodeString
`ClientDataLength` UInt32
`ClientDataHashLength` UInt32
`ClientDataHash` Binary
`CredentialCount` UInt32
`CredentialParameterCount` UInt32

Event ID 1041: Ngc MakeCredential response.

Channel: Operational
Task: NgcMakeCredentialResponse
Opcode: Informational

Message #

Ngc MakeCredential response.

TransactionId: %1
AttestationFormatType: %2
RpIdHash: %4
Flags: %5
SignCount: %6
AAGuid: %7
CredentialId: %9
U2fPublicKey: %10
PublicKey: %12
Response: %14

Fields #

Name	Description
`TransactionId` GUID
`AttestationFormatType` UnicodeString
`RpIdHashLength` UInt32
`RpIdHash` Binary
`Flags` HexInt32
`SignCount` HexInt32
`AAGuid` GUID
`CredentialIdLength` UInt32
`CredentialId` Binary
`U2fPublicKey` Boolean
`PublicKeyLength` UInt32
`PublicKey` Binary
`ResponseLength` UInt32
`Response` Binary

Event ID 1042: Ngc GetAssertion request.

Channel: Operational
Task: NgcGetAssertionRequest
Opcode: Informational

Message #

Ngc GetAssertion request.

TransactionId: %1
RpId: %2
ClientDataHashAlgId: %3 ClientDataLength: %4 ClientDataHash: %6
AllowCredentialCount: %7

Fields #

Name	Description
`TransactionId` GUID
`RpId` UnicodeString
`ClientDataHashAlgId` UnicodeString
`ClientDataLength` UInt32
`ClientDataHashLength` UInt32
`ClientDataHash` Binary
`CredentialCount` UInt32

Event ID 1043: Ngc GetAssertion response.

Channel: Operational
Task: NgcGetAssertionResponse
Opcode: Informational

Message #

Ngc GetAssertion response.

TransactionId: %1
RpIdHash: %3
Flags: %4
SignCount: %5
CredentialId: %7%

Fields #

Name	Description
`TransactionId` GUID
`RpIdHashLength` UInt32
`RpIdHash` Binary
`Flags` HexInt32
`SignCount` HexInt32
`CredentialIdLength` UInt32
`CredentialId` Binary

Event ID 1050: WebAuthN remote RPC request.

Channel: Operational
Level: Informational
Task: WebAuthNRemoteRPCRequest
Opcode: Informational

Message #

WebAuthN remote RPC request.

TransactionId: %1
RemoteRpcRequest: %3

Fields #

Name	Description
`TransactionId` GUID
`RemoteRpcRequestLength` UInt32
`RemoteRpcRequest` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "3AE1EA61-C002-47FB-B06C-4022A8C98929",
    "event_source_name": "",
    "event_id": 1050,
    "version": 0,
    "level": 4,
    "task": 16,
    "opcode": 12,
    "keywords": 9223372036854776065,
    "time_created": "2026-03-11T06:37:46.991338+00:00",
    "event_record_id": 130,
    "correlation": {},
    "execution": {
      "process_id": 8132,
      "thread_id": 10968
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "TransactionId": "39B0A1B3-2EFB-4565-85F8-1963661CDCA3",
    "RemoteRpcRequestLength": 57,
    "RemoteRpcRequest": "A467636F6D6D616E640865666C616773006774696D656F7574006D7472616E73616374696F6E49645000000000000000000000000000000000"
  },
  "message": ""
}

Event ID 1052: WebAuthN remote RPC response.

Channel: Operational
Level: Informational
Task: WebAuthNRemoteRPCResponse
Opcode: Informational

Message #

WebAuthN remote RPC response.

TransactionId: %1
Error: %2. %3
RemoteRpcResponse: %5

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32
`RemoteRpcResponseLength` UInt32
`RemoteRpcResponse` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "3AE1EA61-C002-47FB-B06C-4022A8C98929",
    "event_source_name": "",
    "event_id": 1052,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 12,
    "keywords": 9223372036854776065,
    "time_created": "2026-03-11T06:37:46.994687+00:00",
    "event_record_id": 131,
    "correlation": {},
    "execution": {
      "process_id": 8132,
      "thread_id": 10968
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "TransactionId": "39B0A1B3-2EFB-4565-85F8-1963661CDCA3",
    "Error": "0x0",
    "HResult": 0,
    "RemoteRpcResponseLength": 0,
    "RemoteRpcResponse": ""
  },
  "message": ""
}

Event ID 1060: WebAuthN error at: Action.

Channel: Operational
Task: WebAuthNError
Opcode: Informational

Message #

WebAuthN error at: %2

TransactionId: %1
Error: %3. %4

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Error` HexInt32
`HResult` Int32

Event ID 1070: WebAuthN IsUserVerifyingPlatformAuthenticatorAvailale: value.

Channel: Operational
Level: Informational
Task: WebAuthNIUVPAA
Opcode: Informational

Message #

WebAuthN IsUserVerifyingPlatformAuthenticatorAvailale: %1
Error: %2. %3

Fields #

Name	Description
`value` Boolean
`Error` HexInt32
`HResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "{3AE1EA61-C002-47FB-B06C-4022A8C98929}",
    "event_source_name": "",
    "event_id": 1070,
    "version": 0,
    "level": 4,
    "task": 18,
    "opcode": 12,
    "keywords": -9223372036854775743,
    "time_created": "2026-04-08T19:35:37.1972396+00:00",
    "event_record_id": 83,
    "correlation": {},
    "execution": {
      "process_id": 11476,
      "thread_id": 10452
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "value": "true",
    "Error": "0x0",
    "HResult": "0"
  },
  "message": "WebAuthN IsUserVerifyingPlatformAuthenticatorAvailale: true\r\nError: 0x0. The operation completed successfully."
}

Event ID 1071: WebAuthN ApiVersion: value.

Channel: Operational
Level: Informational
Task: WebAuthNApiVersion
Opcode: Informational

Message #

WebAuthN ApiVersion: %1
Error: %2. %3

Fields #

Name	Description
`value` Int32
`Error` HexInt32
`HResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "3AE1EA61-C002-47FB-B06C-4022A8C98929",
    "event_source_name": "",
    "event_id": 1071,
    "version": 0,
    "level": 4,
    "task": 19,
    "opcode": 12,
    "keywords": 9223372036854775873,
    "time_created": "2023-11-06T01:55:31.345190+00:00",
    "event_record_id": 39,
    "correlation": {},
    "execution": {
      "process_id": 17736,
      "thread_id": 9464
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "value": 4,
    "Error": "0x0",
    "HResult": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1072: WebAuthN CancelCurrentOperation: value.

Channel: Operational
Task: WebAuthNCancelCurrentOperation
Opcode: Informational

Message #

WebAuthN CancelCurrentOperation: %1
Error: %2. %3

Fields #

Name	Description
`value` GUID
`Error` HexInt32
`HResult` Int32

Event ID 1100: Cbor decode error.

Channel: Operational
Task: CborDecodeError
Opcode: Informational

Message #

Cbor decode error.

TransactionId: %1
Function: %2
CborError: %3 %4
ErrorOffset: %5 LineNumber: %6
Encoded: %8

Fields #

Name	Description
`TransactionId` GUID
`Function` AnsiString
`CborError` Int32
`CborErrorString` AnsiString
`ErrorOffset` UInt32
`LineNumber` UInt32
`EncodedLength` UInt32
`Encoded` Binary

Event ID 1101: Cbor encode MakeCredential request.

Channel: Operational
Task: CborEncodeMakeCredentialRequest
Opcode: Informational

Message #

Cbor encode MakeCredential request.

TransactionId: %1
RpId: %2
UserId: %4
ClientDataHashAlgId: %5 ClientDataLength: %6 ClientDataHash: %8
RequireResidentKey: %9
ExcludeCredentialCount: %10
CredentialParameterCount: %11
Request: %13

Fields #

Name	Description
`TransactionId` GUID
`RpId` UnicodeString
`UserIdLength` UInt32
`UserId` Binary
`ClientDataHashAlgId` UnicodeString
`ClientDataLength` UInt32
`ClientDataHashLength` UInt32
`ClientDataHash` Binary
`RequireResidentKey` Boolean
`CredentialCount` UInt32
`CredentialParameterCount` UInt32
`RequestLength` UInt32
`Request` Binary

Event ID 1102: Cbor decode MakeCredential response.

Channel: Operational
Task: CborDecodeMakeCredentialResponse
Opcode: Informational

Message #

Cbor decode MakeCredential response.

TransactionId: %1
AttestationFormatType: %2
RpIdHash: %4
Flags: %5
SignCount: %6
AAGuid: %7
CredentialId: %9
U2fPublicKey: %10
PublicKey: %12
Response: %14

Fields #

Name	Description
`TransactionId` GUID
`AttestationFormatType` UnicodeString
`RpIdHashLength` UInt32
`RpIdHash` Binary
`Flags` HexInt32
`SignCount` HexInt32
`AAGuid` GUID
`CredentialIdLength` UInt32
`CredentialId` Binary
`U2fPublicKey` Boolean
`PublicKeyLength` UInt32
`PublicKey` Binary
`ResponseLength` UInt32
`Response` Binary

Event ID 1103: Cbor encode GetAssertion request.

Channel: Operational
Task: CborEncodeGetAssertionRequest
Opcode: Informational

Message #

Cbor encode GetAssertion request.

TransactionId: %1
RpId: %2
ClientDataHashAlgId: %3 ClientDataLength: %4 ClientDataHash: %6
AllowCredentialCount: %7
Request: %9

Fields #

Name	Description
`TransactionId` GUID
`RpId` UnicodeString
`ClientDataHashAlgId` UnicodeString
`ClientDataLength` UInt32
`ClientDataHashLength` UInt32
`ClientDataHash` Binary
`CredentialCount` UInt32
`RequestLength` UInt32
`Request` Binary

Event ID 1104: Cbor decode GetAssertion response.

Channel: Operational
Task: CborDecodeGetAssertionResponse
Opcode: Informational

Message #

Cbor decode GetAssertion response.

TransactionId: %1
RpIdHash: %3
Flags: %4
SignCount: %5
CredentialId: %7
Response: %9

Fields #

Name	Description
`TransactionId` GUID
`RpIdHashLength` UInt32
`RpIdHash` Binary
`Flags` HexInt32
`SignCount` HexInt32
`CredentialIdLength` UInt32
`CredentialId` Binary
`ResponseLength` UInt32
`Response` Binary

Event ID 2000: Ctap service started successfully.

Channel: Operational
Level: Success
Task: Ctap Service
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "{3AE1EA61-C002-47FB-B06C-4022A8C98929}",
    "event_source_name": "",
    "event_id": 2000,
    "version": 0,
    "level": 16,
    "task": 500,
    "opcode": 10,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-29T16:33:04.4411371+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 3592,
      "thread_id": 3780
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": "Ctap service started successfully."
}

Event ID 2001: Ctap service stopped successfully.

Channel: Operational
Level: Success
Task: Ctap Service
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "guid": "{3AE1EA61-C002-47FB-B06C-4022A8C98929}",
    "event_source_name": "",
    "event_id": 2001,
    "version": 0,
    "level": 16,
    "task": 500,
    "opcode": 11,
    "keywords": -9223372036854775806,
    "time_created": "2026-06-13T05:22:34.8634456+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 3700,
      "thread_id": 4156
    },
    "channel": "Microsoft-Windows-WebAuthN/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": "Ctap service stopped successfully."
}

Event ID 2100: Ctap Command started.

Channel: Operational
Level: Informational
Task: CtapCommand
Opcode: Start

Message #

Ctap %1 started.

TransactionId: %2
Flags: %3
TimeoutMilliseconds: %4
Ticket: %6
Request: %8

Fields #

Name	Description
`Command` UnicodeString
`TransactionId` GUID
`Flags` HexInt32
`TimeoutMilliseconds` UInt32
`TicketLength` UInt32
`Ticket` Binary
`RequestLength` UInt32
`Request` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "event_id": 2100,
    "level": 4,
    "task": 501,
    "opcode": 10,
    "time_created": "2026-04-17T21:49:07.6566494+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-WebAuthN"
  },
  "event_data": {
    "TicketLength": "0",
    "Command": "command",
    "Flags": "0x0",
    "RequestLength": "80",
    "TimeoutMilliseconds": "0",
    "TransactionId": "{d3cbcfa6-7e0d-4cc3-9da8-c05205f86cda}",
    "Request": "A567636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450A6CFCBD30D7EC34C9DA8C05205F86CDA7566696C7465724879627269645472616E73706F7274F4"
  }
}

Event ID 2101: Ctap command started.

Channel: Operational
Task: CtapCommand
Opcode: Start

Message #

Ctap command started.

Request: %2

Fields #

Name	Description
`RequestLength` UInt32
`Request` Binary

Event ID 2102: Ctap Command completed.

Channel: Operational
Level: Success
Task: Ctap Command
Opcode: Stop

Message #

Ctap %1 completed.

TransactionId: %2
Response: %4

Fields #

Name	Description
`Command` UnicodeString
`TransactionId` GUID
`ResponseLength` UInt32
`Response` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WebAuthN",
    "event_id": 2102,
    "level": 16,
    "task": 501,
    "opcode": 11,
    "time_created": "2026-04-17T21:49:07.9559850+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-WebAuthN"
  },
  "event_data": {
    "TransactionId": "{d3cbcfa6-7e0d-4cc3-9da8-c05205f86cda}",
    "Command": "command",
    "ResponseLength": "0"
  }
}

Event ID 2103: Ctap Command completed.

Channel: Operational
Task: CtapCommand
Opcode: Stop

Message #

Ctap %1 completed.

TransactionId: %2
Error: %3. %4

Fields #

Name	Description
`Command` UnicodeString
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2104: Ctap device info.

Channel: Operational
Task: CtapDeviceInfo
Opcode: Informational

Message #

Ctap device info.

TransactionId: %1
ProviderName: %2
DevicePath: %3
Manufacturer: %4
Product: %5
AAGuid: %6
U2fProtocol: %7

Fields #

Name	Description
`TransactionId` GUID
`ProviderName` UnicodeString
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean

Event ID 2105: Ctap Function: Function Location: Location.

Channel: Operational
Task: CtapFunction
Opcode: Informational

Message #

Ctap Function: %1 Location: %2

Error: %3. %4

Fields #

Name	Description
`Function` AnsiString
`Location` AnsiString
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2106: Ctap Name: Name Value: Value.

Channel: Operational
Task: CtapFunction
Opcode: Informational

Message #

Ctap Name: %1 Value: %2

Fields #

Name	Description
`Name` UnicodeString
`Value` UnicodeString

Event ID 2107

Channel: Operational
Task: CtapFunction
Opcode: Informational

Event ID 2110: Ctap device device state info.

Channel: Operational
Task: WNFCtapDeviceStateInfo
Opcode: Informational

Message #

Ctap device device state info.

Transport Type: %1
WnfState: %2
Error: %3. %4

Fields #

Name	Description
`Transport` HexInt32
`WnfState` HexInt32
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2111: Ctap device change notify info.

Channel: Operational
Task: WNFCtapDeviceChangeNotifyInfo
Opcode: Informational

Message #

Ctap device change notify info.

Transport Type: %1

Fields #

Name	Description
`Transport` HexInt32

Event ID 2200: Ctap Usb provider thread started.

Channel: Operational
Task: CtapUsbProviderThread
Opcode: Start

Message #

Ctap Usb provider thread started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2201: Ctap Usb provider thread completed.

Channel: Operational
Task: Ctap Usb Provider Thread
Opcode: Stop

Message #

Ctap Usb provider thread completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2202: Ctap Usb provider thread completed.

Channel: Operational
Task: CtapUsbProviderThread
Opcode: Stop

Message #

Ctap Usb provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2203: Ctap Usb provider thread completed.

Channel: Operational
Task: CtapUsbProviderThread
Opcode: Stop

Message #

Ctap Usb provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2210: Ctap Usb device thread started.

Channel: Operational
Task: CtapUsbDeviceThread
Opcode: Start

Message #

Ctap Usb device thread started.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString

Event ID 2211: Ctap Usb device thread completed.

Channel: Operational
Task: Ctap Usb Device Thread
Opcode: Stop

Message #

Ctap Usb device thread completed.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4
AAGuid: %5
U2fProtocol: %6

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean

Event ID 2212: Ctap Usb device thread completed.

Channel: Operational
Task: CtapUsbDeviceThread
Opcode: Stop

Message #

Ctap Usb device thread completed.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4
AAGuid: %5
U2fProtocol: %6
State: %7
Status: %8
Error: %9. %10

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2213: Ctap Usb device thread completed.

Channel: Operational
Task: CtapUsbDeviceThread
Opcode: Stop

Message #

Ctap Usb device thread completed.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4
AAGuid: %5
U2fProtocol: %6
State: %7
Status: %8
Error: %9. %10

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2220: Ctap Usb add device.

Channel: Operational
Task: CtapUsbAdd
Opcode: Informational

Message #

Ctap Usb add device.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString

Event ID 2221: Ctap Usb remove device.

Channel: Operational
Task: CtapUsbRemove
Opcode: Informational

Message #

Ctap Usb remove device.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString

Event ID 2222: Ctap Usb device changes.

Channel: Operational
Task: CtapUsbChanges
Opcode: Informational

Message #

Ctap Usb device changes.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2223: Ctap Usb U2F device.

Channel: Operational
Task: CtapUsbSwitchToU2F
Opcode: Informational

Message #

Ctap Usb U2F device.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString

Event ID 2224: Ctap Usb connect to device.

Channel: Operational
Task: CtapUsbConnect
Opcode: Informational

Message #

Ctap Usb connect to device.

TransactionId: %1
DevicePath: %2
Manufacturer: %3
Product: %4
DeviceErr: %5
Status: %6
Error: %7. %8

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`Manufacturer` UnicodeString
`Product` UnicodeString
`DeviceErr` HexInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2225: Ctap Usb Send Receive.

Channel: Operational
Task: CtapUsbSendReceive
Opcode: Informational

Message #

Ctap Usb Send Receive:

TransactionId: %1
Request Command: %2 Response Command: %5
Request: %4
Response: %7

Fields #

Name	Description
`TransactionId` GUID
`RequestCommand` UInt8
`RequestLength` UInt32
`Request` Binary
`ResponseCommand` UInt8
`ResponseLength` UInt32
`Response` Binary

Event ID 2226: Ctap Usb Send Receive.

Channel: Operational
Task: CtapUsbSendReceive
Opcode: Informational

Message #

Ctap Usb Send Receive:

TransactionId: %1
Request Command: %2 Response Command: %5
Request: %4
Response: %7
Error: %8. %9

Fields #

Name	Description
`TransactionId` GUID
`RequestCommand` UInt8
`RequestLength` UInt32
`Request` Binary
`ResponseCommand` UInt8
`ResponseLength` UInt32
`Response` Binary
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2250: Ctap Ble provider thread started.

Channel: Operational
Task: CtapBleProviderThread
Opcode: Start

Message #

Ctap Ble provider thread started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2251: Ctap Ble provider thread completed.

Channel: Operational
Task: Ctap Ble Provider Thread
Opcode: Stop

Message #

Ctap Ble provider thread completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2252: Ctap Ble provider thread completed.

Channel: Operational
Task: CtapBleProviderThread
Opcode: Stop

Message #

Ctap Ble provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2253: Ctap Ble provider thread completed.

Channel: Operational
Task: CtapBleProviderThread
Opcode: Stop

Message #

Ctap Ble provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2260: Ctap Ble device thread started.

Channel: Operational
Task: CtapBleDeviceThread
Opcode: Start

Message #

Ctap Ble device thread started.

TransactionId: %1
DevicePath: %2
PairedName: %3

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`PairedName` UnicodeString

Event ID 2261: Ctap Ble device thread completed.

Channel: Operational
Task: Ctap Ble Device Thread
Opcode: Stop

Message #

Ctap Ble device thread completed.

TransactionId: %1
DevicePath: %2
PairedName: %3
AAGuid: %4
U2fProtocol: %5

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`PairedName` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean

Event ID 2262: Ctap Ble device thread completed.

Channel: Operational
Task: CtapBleDeviceThread
Opcode: Stop

Message #

Ctap Ble device thread completed.

TransactionId: %1
DevicePath: %2
PairedName: %3
AAGuid: %4
U2fProtocol: %5
State: %6
Status: %7
Error: %8. %9

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`PairedName` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2263: Ctap Ble device thread completed.

Channel: Operational
Task: CtapBleDeviceThread
Opcode: Stop

Message #

Ctap Ble device thread completed.

TransactionId: %1
DevicePath: %2
PairedName: %3
AAGuid: %4
U2fProtocol: %5
State: %6
Status: %7
Error: %8. %9

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`PairedName` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2270: Ctap Ble Function: Function Location: Location.

Channel: Operational
Task: CtapBleFunction
Opcode: Informational

Message #

Ctap Ble Function: %1 Location: %2

Error: %3. %4

Fields #

Name	Description
`Function` AnsiString
`Location` AnsiString
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2271: Ctap Ble U2F device.

Channel: Operational
Task: CtapBleSwitchToU2F
Opcode: Informational

Message #

Ctap Ble U2F device.

TransactionId: %1
DevicePath: %2
PairedName: %3

Fields #

Name	Description
`TransactionId` GUID
`DevicePath` UnicodeString
`PairedName` UnicodeString

Event ID 2272: Ctap Ble Send Receive.

Channel: Operational
Task: CtapBleSendReceive
Opcode: Informational

Message #

Ctap Ble Send Receive:

TransactionId: %1
Request Command: %2 Response Command: %5
Request: %4
Response: %7

Fields #

Name	Description
`TransactionId` GUID
`RequestCommand` UInt8
`RequestLength` UInt32
`Request` Binary
`ResponseCommand` UInt8
`ResponseLength` UInt32
`Response` Binary

Event ID 2273: Ctap Ble Send Receive.

Channel: Operational
Task: CtapBleSendReceive
Opcode: Informational

Message #

Ctap Ble Send Receive:

TransactionId: %1
Request Command: %2 Response Command: %5
Request: %4
Response: %7
Location: %8
Error: %9. %10

Fields #

Name	Description
`TransactionId` GUID
`RequestCommand` UInt8
`RequestLength` UInt32
`Request` Binary
`ResponseCommand` UInt8
`ResponseLength` UInt32
`Response` Binary
`Location` AnsiString
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2300: Ctap Nfc provider thread started.

Channel: Operational
Task: CtapNfcProviderThread
Opcode: Start

Message #

Ctap Nfc provider thread started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2301: Ctap Nfc provider thread completed.

Channel: Operational
Task: Ctap Nfc Provider Thread
Opcode: Stop

Message #

Ctap Nfc provider thread completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2302: Ctap Nfc provider thread completed.

Channel: Operational
Task: CtapNfcProviderThread
Opcode: Stop

Message #

Ctap Nfc provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2303: Ctap Nfc provider thread completed.

Channel: Operational
Task: CtapNfcProviderThread
Opcode: Stop

Message #

Ctap Nfc provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2310: Ctap Nfc reader thread started.

Channel: Operational
Task: CtapNfcReaderThread
Opcode: Start

Message #

Ctap Nfc reader thread started.

TransactionId: %1
Reader: %2

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString

Event ID 2311: Ctap Nfc reader thread completed.

Channel: Operational
Task: Ctap Nfc Reader Thread
Opcode: Stop

Message #

Ctap Nfc reader thread completed.

TransactionId: %1
Reader: %2
AAGuid: %3
U2fProtocol: %4

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean

Event ID 2312: Ctap Nfc reader thread completed.

Channel: Operational
Task: CtapNfcReaderThread
Opcode: Stop

Message #

Ctap Nfc reader thread completed.

TransactionId: %1
Reader: %2
AAGuid: %3
U2fProtocol: %4
State: %5
Status: %6
Error: %7. %8

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2313: Ctap Nfc reader thread completed.

Channel: Operational
Task: CtapNfcReaderThread
Opcode: Stop

Message #

Ctap Nfc reader thread completed.

TransactionId: %1
Reader: %2
AAGuid: %3
U2fProtocol: %4
State: %5
Status: %6
Error: %7. %8

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString
`AAGuid` GUID
`U2fProtocol` Boolean
`State` UInt32
`Status` HexInt32	NTSTATUS reference
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2314: Ctap Nfc reader manager thread started.

Channel: Operational
Task: CtapNfcReaderManagerThread
Opcode: Start

Message #

Ctap Nfc reader manager thread started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2315: Ctap Nfc reader manager thread completed.

Channel: Operational
Task: Ctap Nfc Reader Manager Thread
Opcode: Stop

Message #

Ctap Nfc reader manager thread completed.

TransactionId: %1
NumberOfTimesScardCancelCommandsSent: %2

Fields #

Name	Description
`TransactionId` GUID
`NumberOfTimesScardCancelCommandsSent` UInt32

Event ID 2316: Cancelling Reader Threads.

Channel: Operational
Task: CtapNfcReaderManagerThread
Opcode: Informational

Message #

Cancelling Reader Threads.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID
`CallCancelled` Boolean

Event ID 2320: Ctap Nfc add reader.

Channel: Operational
Task: CtapNfcAddReader
Opcode: Informational

Message #

Ctap Nfc add reader.

TransactionId: %1
Reader: %2

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString

Event ID 2321: Ctap Nfc skip reader for: Action.

Channel: Operational
Task: CtapNfcSkipReader
Opcode: Informational

Message #

Ctap Nfc skip reader for: %2.

TransactionId: %1
Reader: %3
DeviceInstanceId: %4

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Reader` UnicodeString
`DeviceInstanceId` UnicodeString

Event ID 2322: Ctap Nfc transition reader for: Action.

Channel: Operational
Task: CtapNfcTransitionReader
Opcode: Informational

Message #

Ctap Nfc transition reader for: %2.

TransactionId: %1
Reader: %3

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Reader` UnicodeString

Event ID 2323: Ctap Nfc send message warning for: Action.

Channel: Operational
Task: CtapNfcSendMessage
Opcode: Informational

Message #

Ctap Nfc send message warning for: %2.

TransactionId: %1
Reader: %3
ApduStatus: %4
DeviceStatus: %5
SmartCardError: %6. %7

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Reader` UnicodeString
`ApduStatus` UInt16
`DeviceStatus` HexInt32
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2324: Ctap Nfc send request error for: Action.

Channel: Operational
Task: CtapNfcSendRequest
Opcode: Informational

Message #

Ctap Nfc send request error for: %2.

TransactionId: %1
Reader: %3
ApduStatus: %4
DeviceStatus: %5
Error: %6. %7

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Reader` UnicodeString
`ApduStatus` UInt16
`DeviceStatus` HexInt32
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2325: Ctap Nfc U2F device.

Channel: Operational
Task: CtapNfcSwitchToU2F
Opcode: Informational

Message #

Ctap Nfc U2F device.

TransactionId: %1
Reader: %2

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString

Event ID 2326: Ctap Nfc send message at: Action.

Channel: Operational
Task: CtapNfcSendMessage
Opcode: Informational

Message #

Ctap Nfc send message at: %2.

TransactionId: %1
Reader: %3

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Reader` UnicodeString

Event ID 2327: Ctap Nfc SCardTransmit Request.

Channel: Operational
Task: CtapNfcSCardTransmitRequest
Opcode: Informational

Message #

Ctap Nfc SCardTransmit Request:

TransactionId: %1
Reader: %2

Request: %3 bytes
%4

Response data: %5 bytes
%6

Apdu Status: %7

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString
`RequestLength` UInt32
`Request` Binary
`ResponseLength` UInt32
`Response` Binary
`ApduStatus` UInt16

Event ID 2328: Ctap Nfc SCardTransmit Request.

Channel: Operational
Task: CtapNfcSCardTransmitRequest
Opcode: Informational

Message #

Ctap Nfc SCardTransmit Request:

TransactionId: %1
Reader: %2

Request: %3 bytes
%4

Response data: %5 bytes
%6

Apdu Status: %7

Error: %8. %9

Fields #

Name	Description
`TransactionId` GUID
`Reader` UnicodeString
`RequestLength` UInt32
`Request` Binary
`ResponseLength` UInt32
`Response` Binary
`ApduStatus` UInt16
`Error` HexInt32
`Win32Error` HexInt32

Event ID 2329: Ctap Hybrid process Ctap command request callback started.

Channel: Operational
Task: CtapHybridProcessCtapCommandRequestCallback
Opcode: Start

Message #

Ctap Hybrid process Ctap command request callback started. 

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2330: Ctap Hybrid process Ctap command request callback completed.

Channel: Operational
Task: CtapHybridProcessCtapCommandRequestCallback
Opcode: Stop

Message #

Ctap Hybrid process Ctap command request callback completed. 

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2331: Ctap Hybrid process Ctap command request callback completed with error.

Channel: Operational
Task: CtapHybridProcessCtapCommandRequestCallback
Opcode: Stop

Message #

Ctap Hybrid process Ctap command request callback completed with error. 

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`HResult` Int32

Event ID 2332: Ctap Hybrid Write Message: Message.

Channel: Operational
Task: CtapHybridWriteMessage
Opcode: Informational

Message #

Ctap Hybrid Write Message: %2

Fields #

Name	Description
`MessageLength` UInt32
`Message` Binary

Event ID 2333: Ctap Hybrid Read Message: Message.

Channel: Operational
Task: CtapHybridReadMessage
Opcode: Informational

Message #

Ctap Hybrid Read Message: %2

Fields #

Name	Description
`MessageLength` UInt32
`Message` Binary

Event ID 2334: Ctap Hybrid Protocol setup started.

Channel: Operational
Task: CtapHybridProtocolSetup
Opcode: Start

Message #

Ctap Hybrid Protocol setup started. 

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2335: Ctap Hybrid Protocol setup completed.

Channel: Operational
Task: CtapHybridProtocolSetup
Opcode: Stop

Message #

Ctap Hybrid Protocol setup completed. 

TransactionId: %1 
SetupType: %2

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Error` HexInt32
`HResult` Int32

Event ID 2336: Ctap Hybrid Protocol setup completed with error.

Channel: Operational
Task: CtapHybridProtocolSetup
Opcode: Stop

Message #

Ctap Hybrid Protocol setup completed with error. 

TransactionId: %1 
SetupType: %2 
Error: %3. %4

Fields #

Name	Description
`TransactionId` GUID
`Action` AnsiString
`Error` HexInt32
`HResult` Int32

Event ID 2337: Ctap Hybrid Linked Device Saved.

Channel: Operational
Task: CtapHybridLinkedDeviceSaved
Opcode: Informational

Message #

Ctap Hybrid Linked Device Saved. 

Success: %1 
Error: %2. %3

Fields #

Name	Description
`value` Boolean
`Error` HexInt32
`HResult` Int32

Event ID 2400: Ctap Test provider thread started.

Channel: Operational
Task: CtapTestProviderThread
Opcode: Start

Message #

Ctap Test provider thread started.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2401: Ctap Test provider thread completed.

Channel: Operational
Task: Ctap Test Provider Thread
Opcode: Stop

Message #

Ctap Test provider thread completed.

TransactionId: %1

Fields #

Name	Description
`TransactionId` GUID

Event ID 2402: Ctap Test provider thread completed.

Channel: Operational
Task: CtapTestProviderThread
Opcode: Stop

Message #

Ctap Test provider thread completed.

TransactionId: %1
Error: %2. %3

Fields #

Name	Description
`TransactionId` GUID
`Error` HexInt32
`Win32Error` HexInt32

Event ID 5002: Trust group deletion synchronized

Channel: Operational, Operatonal
Task: Sync
Opcode: Informational

Event ID 5009: User storage created

Channel: Operational, Operatonal
Task: LocalStore
Opcode: Informational

Fields #

Name	Description
`StorageID` GUID
`UserSid` SID

Event ID 5010: Synchronization state:

Channel: Operational
Task: SyncState
Opcode: Informational

Description

Synchronization state.

Fields #

Name	Description
`SyncState` UInt32

Event ID 5010: Synchronization state: SyncState.

Channel: Operatonal
Task: SyncState
Opcode: Informational

Message #

Synchronization state: %1

Fields #

Name	Description
`SyncState` UInt32

Event ID 6006: Trust group deleted

Channel: Operational, Operatonal
Task: TrustGroup
Opcode: Informational

Event ID 6007: Cleaned up Local Store

Channel: Operational, Operatonal
Task: LocalStore
Opcode: Informational

Event ID 6011: This Windows device was not found in the Trusted Device list, resetting local state

Channel: Operational, Operatonal
Task: TrustedDevice
Opcode: Informational

Event ID 6250

Channel: Operational
Task: CredentialMetadataFieldMissing
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString

Event ID 6251

Channel: Operational
Task: GetKCMUVKey
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`KeyName` UnicodeString
`NumKeysFound` UInt32

Event ID 6254

Channel: Operational
Task: CredentialMetadataFieldMissing
Opcode: Informational

Description

Error when trying to decode a plugin passkey. Some metadata fields may be missing or incorrect.

Fields #

Name	Description
`PluginClsId` UnicodeString

Event ID 6254: Error when trying to decode a plugin passkey.

Channel: Operational
Task: CredentialMetadataFieldMissing
Opcode: Informational

Description

Error when trying to decode a plugin passkey. Some metadata fields may be missing or incorrect.

Message #

Error when trying to decode a plugin passkey. Some metadata fields may be missing or incorrect.
Plugin ClsId: %1

Fields #

Name	Description
`PluginClsId` UnicodeString

Event ID 7000: Key rotation failed

Channel: Operational, Operatonal
Task: KeyRotation
Opcode: Stop

Fields #

Name	Description
`Error` HexInt32

Event ID 7001: Cloud store operation failed

Channel: Operational, Operatonal
Task: Sync
Opcode: Stop

Fields #

Name	Description
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`PropertyType` UInt32
`BackupId` UnicodeString
`CorrelationVector` AnsiString
`Error` HexInt32

Event ID 7003: Failed to add trusted device

Channel: Operational, Operatonal
Task: TrustedDevice
Opcode: Stop

Fields #

Name	Description
`Error` HexInt32

Event ID 7004: Failed to delete trusted device

Channel: Operational, Operatonal
Task: TrustedDevice
Opcode: Stop

Fields #

Name	Description
`Error` HexInt32

Event ID 7005: Failed to rename trusted device

Channel: Operational, Operatonal
Task: TrustedDevice
Opcode: Stop

Fields #

Name	Description
`Error` HexInt32

Event ID 7008: Local store operation failed

Channel: Operational, Operatonal
Task: LocalStore
Opcode: Stop

Fields #

Name	Description
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`PropertyType` UInt32
`BackupId` UnicodeString
`CorrelationVector` AnsiString
`Error` HexInt32

Event ID 7251

Channel: Operational
Task: GetKCMUVKey
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`KeyName` UnicodeString
`Error` HexInt32
`HResult` Int32

Event ID 7252

Channel: Operational
Task: PluginGetLockStatus
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`Error` HexInt32
`HResult` Int32

Event ID 7253

Channel: Operational
Task: PluginMakeCredential
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`Error` HexInt32
`HResult` Int32

Event ID 7254

Channel: Operational
Task: PluginGetAssertion
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`Error` HexInt32
`HResult` Int32

Event ID 7255

Channel: Operational
Task: PluginCancelOperation
Opcode: Informational

Fields #

Name	Description
`PluginClsId` UnicodeString
`Error` HexInt32
`HResult` Int32

Event ID 8000: Key rotation succeeded

Channel: Operational, Operatonal

Fields #

Name	Description
`EncryptionKeyType` UInt32

Event ID 8001: Cloud store operation succeeded

Channel: Operational, Operatonal

Fields #

Name	Description
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`PropertyType` UInt32
`BackupId` UnicodeString
`CorrelationVector` AnsiString

Event ID 8003: Trusted device successfully added

Channel: Operational, Operatonal

Fields #

Name	Description
`DeviceID` UInt32

Event ID 8004: Trusted device deleted successfully

Channel: Operational, Operatonal

Fields #

Name	Description
`DeviceID` UInt32

Event ID 8005: Trusted device renamed successfully

Channel: Operational, Operatonal

Fields #

Name	Description
`DeviceID` UInt32

Event ID 8008: Local store operation succeeded

Channel: Operational, Debug

Fields #

Name	Description
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`PropertyType` UInt32
`BackupId` UnicodeString
`CorrelationVector` AnsiString

Provenance

ETW provider GUID 3ae1ea61-c002-47fb-b06c-4022a8c98929

Defined in webauthn.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB