Microsoft-Windows-Winlogon

Event	Title	Channel	Sample	Rule
1	Authentication started.	Operational	Y	N
2	Authentication stopped.	Operational	Y	N
3	UpdatePerUserSystemParametersStart	Diagnostic	N	N
4	UpdatePerUserSystemParametersStop	Diagnostic	N	N
5	CheckWindowsLicenseStatusStart	Diagnostic	N	N
6	CheckWindowsLicenseStatusStop	Diagnostic	N	N
7	RestoringNetConnectionsStart	Diagnostic	N	N
8	RestoringNetConnectionsStop	Diagnostic	N	N
9	ExecuteShellCommandListStart	Diagnostic	N	N
10	ExecuteShellCommandListStop	Diagnostic	N	N
11	ThemesOnLogonPreStart	Diagnostic	N	N
12	ThemesOnLogonPreStop	Diagnostic	N	N
13	ThemesOnLogonPostStart	Diagnostic	N	N
14	ThemesOnLogonPostStop	Diagnostic	N	N
51	ThemesOnLogoffStart	Diagnostic	N	N
52	ThemesOnLogoffStop	Diagnostic	N	N
61	DwmpCreateSessionProcessStart	Diagnostic	N	N
62	DwmpCreateSessionProcessStop	Diagnostic	N	N
64	DwmpTerminateSessionProcessStart	Diagnostic	N	N
65	DwmpTerminateSessionProcessStop	Diagnostic	N	N
67	DwmpNotifyUserLogonStart	Diagnostic	N	N
68	DwmpNotifyUserLogonStop	Diagnostic	N	N
70	ThemesOnEarlyCreateSessionStart	Diagnostic	N	N
71	ThemesOnEarlyCreateSessionStop	Diagnostic	N	N
72	DwmpNotifyUserLogoffStart	Diagnostic	N	N
73	DwmpNotifyUserLogoffStop	Diagnostic	N	N
101	CreatePrimaryTerminalStart	Diagnostic	N	N
102	CreatePrimaryTerminalStop	Diagnostic	N	N
103	StartLogonUIStart	Diagnostic	N	N
104	StartLogonUIStop	Diagnostic	N	N
105	RunStateMachineStart	Diagnostic	N	N
106	RunStateMachineStop	Diagnostic	N	N
107	WaitForLSMStart	Diagnostic	N	N
108	WaitForLSMStop	Diagnostic	N	N
201	DisplayWelcomeScreenStart	Diagnostic	N	N
202	DisplayWelcomeScreenStop	Diagnostic	N	N
203	RequestCredentialsStart	Diagnostic	N	N
204	RequestCredentialsStop	Diagnostic	N	N
205	ThemesOnCreateSessionStart	Diagnostic	N	N
206	ThemesOnCreateSessionStop	Diagnostic	N	N
207	ThemesOnTerminateSessionStart	Diagnostic	N	N
208	ThemesOnTerminateSessionStop	Diagnostic	N	N
301	ReceivedLogoffRequest	Diagnostic	N	N
401	ShutdownWindowsStart	Diagnostic	N	N
402	ShutdownWindowsStop	Diagnostic	N	N
403	InitiateShutdownStart	Diagnostic	N	N
404	InitiateShutdownStop	Diagnostic	N	N
501	WluiServerStartupStart	Diagnostic	N	N
502	WluiServerStartupStop	Diagnostic	N	N
503	WluiServerShutdownStart	Diagnostic	N	N
504	WluiServerShutdownStop	Diagnostic	N	N
505	WluiServerStartup	Operational	N	N
801	NotifyExecuteStart	Diagnostic	N	N
802	NotifyExecuteStop	Diagnostic	N	N
803	NotifyServicesStart	Diagnostic	N	N
804	NotifyServicesStop	Diagnostic	N	N
805	NotifySubscriberStart	Diagnostic	N	N
806	NotifySubscriberStop	Diagnostic	N	N
807	NotifySubscriberNotificationPended	Diagnostic	N	N
808	NotifySubscriberNotificationFailed	Diagnostic	N	N
809	ConnectToSubscriberStart	Diagnostic	N	N
810	ConnectToSubscriberStop	Diagnostic	N	N
811	The winlogon notification subscriber <SubscriberName> began handling the …	Operational	Y	N
812	The winlogon notification subscriber <SubscriberName> finished handling the …	Operational	Y	N
1001	Logon hours expiration warning.	Operational	N	N
1002	The shell stopped unexpectedly and Data_0 was restarted	Application	Y	N
1002	The shell stopped unexpectedly and %1 was restarted	Operational	Y	N
1101	The computer will be locked because the user has exceeded the maximum number of …	Operational	N	N
1102	The computer will be rebooted because the user has exceeded the maximum number …	Operational	N	N
1103	The user is approaching the threshold for maximum number of failed logon …	Operational	N	N
1104	Encryption Provider initialization failed.	Operational	N	N
4002	The logon hours restriction policy is applied to the logged on user	Operational	N	N
4003	The Windows logon process has failed to switch the desktop	Operational	N	N
4004	The Windows logon process has failed to terminate the currently logged on user's …	Application, Operational	Y	N
4005	The Windows logon process has unexpectedly terminated	Operational	N	N
4006	The Windows logon process has failed to spawn a user application	Operational	N	N
4007	The Windows logon process has failed to disconnect the user session	Operational	N	N
4008	The Windows logon process has failed to connect the user session	Operational	N	N
4101	Windows license validated.	Application	Y	N
4101	Windows license validated	Operational	N	N
4102	Windows license is invalid	Operational	N	N
4103	Windows license activation failed	Operational	N	N
4104	Accessing Windows in Notification period	Application, Operational	Y	N
4105	Windows is in Notification period	Application, Operational	Y	N
5001	UserBootStart	Diagnostic	N	N
5002	UserBootStop	Diagnostic	N	N
5003	UserBoot	Diagnostic	N	N
5005	UserShellLaunch	Diagnostic	N	N
5007	SystemBootStop_V2	Diagnostic	N	N
6000	The winlogon notification subscriber <SessionEnv> was unavailable to handle a …	Application	Y	N
6000	The winlogon notification subscriber <Data_0> was unavailable to handle a …	Operational	Y	N
6001	The winlogon notification subscriber <SessionEnv> failed a notification event.	Application	Y	N
6001	The winlogon notification subscriber <Flags> failed a notification event	Diagnostic	N	N
6002	The winlogon notification subscriber registration database cannot be loaded	Operational	N	N
6003	The winlogon notification subscriber <SessionEnv> was unavailable to handle a …	Application	Y	N
6003	The winlogon notification subscriber <Data_0> was unavailable to handle a …	Operational	Y	N
6004	The winlogon notification subscriber <TrustedInstaller> failed a critical …	Application	Y	N
6004	The winlogon notification subscriber <Data_0> failed a critical notification …	Operational	Y	N
6005	The winlogon notification subscriber <GPClient> is taking long time to handle …	Application	Y	N
6005	The winlogon notification subscriber <Data_0> is taking long time to handle the …	Operational	Y	N
6006	The winlogon notification subscriber <GPClient> took 119 second(s) to handle the …	Application	Y	N
6006	The winlogon notification subscriber <Data_0> took Data_1 second(s) to handle …	Operational	Y	N
6101	LogoffRequestToUserFeedbackStart	Diagnostic	N	N
6102	LogoffRequestToUserFeedbackStop	Diagnostic	N	N
6103	LogoffAppsTerminationToSessionEndStart	Diagnostic	N	N
6104	LogoffAppsTerminationToSessionEndStop	Diagnostic	N	N
6105	UnlockStart	Diagnostic	N	N
6106	UnlockStop	Diagnostic	N	N
6107	UnlockStop6107	Diagnostic	N	N
6108	LogonStart	Diagnostic	N	N
6109	LogonStop	Diagnostic	N	N
6110	LogonStop6110	Diagnostic	N	N
6111	LogonStop6111	Diagnostic	N	N
6112	LogonStop6112	Diagnostic	N	N
6113	LockStart	Diagnostic	N	N
6114	LockStop	Diagnostic	N	N
6115	LockStop6115	Diagnostic	N	N
6116	Logoff	Diagnostic	N	N
6117	DelayLockDisplayLockScreen	Diagnostic	N	N
6118	KillingScreenSaverToLockWorkStation	Diagnostic	N	N
6119	AutomaticRestartSignOn	Diagnostic	N	N
6120	HotKeyLockDesktopInvoked	Diagnostic	N	N
6121	PINResetLogon	Diagnostic	N	N
6122	PINResetUnlock	Diagnostic	N	N
6123	AssignedAccessLogon	Diagnostic	N	N
6124	AssignedAccessUnlock	Diagnostic	N	N
7001	User Logon Notification for Customer Experience Improvement Program	System	Y	N
7002	User Logoff Notification for Customer Experience Improvement Program	System	Y	N
1073742826	The shell stopped unexpectedly and %1 was restarted.	Operational	Y	N
1073745826	The logon hours restriction policy is applied to the logged on user.	Operational	N	N
1073745925	Windows license validated.	Operational	N	N
1073745928	Accessing Windows in Notification period.	Operational	N	N
2147487654	The Windows logon process has failed to spawn a user application.	Operational	N	N
2147487655	The Windows logon process has failed to disconnect the user session.	Operational	N	N
2147487656	The Windows logon process has failed to connect the user session.	Operational	N	N
2147487753	Windows is in Notification period.	Operational	N	N
2147489648	The winlogon notification subscriber <.	Operational	Y	N
2147489649	The winlogon notification subscriber <.	Operational	N	N
2147489650	The winlogon notification subscriber registration database cannot be loaded.	Operational	N	N
2147489651	The winlogon notification subscriber <.	Operational	N	N
2147489652	The winlogon notification subscriber <.	Operational	N	N
2147489653	The winlogon notification subscriber <.	Operational	Y	N
2147489654	The winlogon notification subscriber <.	Operational	Y	N
3221229475	The Windows logon process has failed to switch the desktop.	Operational	N	N
3221229476	The Windows logon process has failed to terminate the currently logged on user's …	Operational	N	N
3221229477	The Windows logon process has unexpectedly terminated.	Operational	N	N
3221229574	Windows license is invalid.	Operational	N	N
3221229575	Windows license activation failed.	Operational	N	N

Event ID 1: Authentication started.

Channel: Operational
Level: Informational
Task: AuthenticateUser
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": 4611721202799542272,
    "time_created": "2026-05-29T16:33:48.0082811+00:00",
    "event_record_id": 533,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 1104
    },
    "channel": "Microsoft-Windows-Winlogon/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Authentication started."
}

Event ID 2: Authentication stopped.

Channel: Operational
Level: Informational
Task: AuthenticateUser
Opcode: Stop

Description

Authentication stopped. Result Win32Status.

Message #

Authentication stopped. Result %1

Fields #

Name	Description
`Win32Status` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": 4611721202799542272,
    "time_created": "2026-05-29T16:33:48.1550444+00:00",
    "event_record_id": 534,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 1104
    },
    "channel": "Microsoft-Windows-Winlogon/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Win32Status": "0"
  },
  "message": "Authentication stopped. Result 0"
}

Event ID 3: UpdatePerUserSystemParametersStart

Channel: Diagnostic
Task: UpdatePerUserSystemParameters
Opcode: Start

Fields #

Name	Description
`Flags` UInt32

Event ID 4: UpdatePerUserSystemParametersStop

Channel: Diagnostic
Task: UpdatePerUserSystemParameters
Opcode: Stop

Fields #

Name	Description
`Flags` UInt32

Event ID 5: CheckWindowsLicenseStatusStart

Channel: Diagnostic
Task: CheckWindowsLicenseStatus
Opcode: Start

Event ID 6: CheckWindowsLicenseStatusStop

Channel: Diagnostic
Task: CheckWindowsLicenseStatus
Opcode: Stop

Event ID 7: RestoringNetConnectionsStart

Channel: Diagnostic
Task: RestoringNetConnections
Opcode: Start

Event ID 8: RestoringNetConnectionsStop

Channel: Diagnostic
Task: RestoringNetConnections
Opcode: Stop

Event ID 9: ExecuteShellCommandListStart

Channel: Diagnostic
Task: ExecuteShellCommandList
Opcode: Start

Fields #

Name	Description
`CommandList` UnicodeString

Event ID 10: ExecuteShellCommandListStop

Channel: Diagnostic
Task: ExecuteShellCommandList
Opcode: Stop

Event ID 11: ThemesOnLogonPreStart

Channel: Diagnostic
Task: ThemesOnLogonPre
Opcode: Start

Event ID 12: ThemesOnLogonPreStop

Channel: Diagnostic
Task: ThemesOnLogonPre
Opcode: Stop

Event ID 13: ThemesOnLogonPostStart

Channel: Diagnostic
Task: ThemesOnLogonPost
Opcode: Start

Event ID 14: ThemesOnLogonPostStop

Channel: Diagnostic
Task: ThemesOnLogonPost
Opcode: Stop

Event ID 51: ThemesOnLogoffStart

Channel: Diagnostic
Task: ThemesOnLogoff
Opcode: Start

Event ID 52: ThemesOnLogoffStop

Channel: Diagnostic
Task: ThemesOnLogoff
Opcode: Stop

Event ID 61: DwmpCreateSessionProcessStart

Channel: Diagnostic
Task: DwmpCreateSessionProcess
Opcode: Start

Event ID 62: DwmpCreateSessionProcessStop

Channel: Diagnostic
Task: DwmpCreateSessionProcess
Opcode: Stop

Event ID 64: DwmpTerminateSessionProcessStart

Channel: Diagnostic
Task: DwmpTerminateSessionProcess
Opcode: Start

Event ID 65: DwmpTerminateSessionProcessStop

Channel: Diagnostic
Task: DwmpTerminateSessionProcess
Opcode: Stop

Event ID 67: DwmpNotifyUserLogonStart

Channel: Diagnostic
Task: DwmpNotifyUserLogon
Opcode: Start

Event ID 68: DwmpNotifyUserLogonStop

Channel: Diagnostic
Task: DwmpNotifyUserLogon
Opcode: Stop

Event ID 70: ThemesOnEarlyCreateSessionStart

Channel: Diagnostic
Task: ThemesOnEarlyCreateSession
Opcode: Start

Event ID 71: ThemesOnEarlyCreateSessionStop

Channel: Diagnostic
Task: ThemesOnEarlyCreateSession
Opcode: Stop

Event ID 72: DwmpNotifyUserLogoffStart

Channel: Diagnostic
Task: DwmpNotifyUserLogoff
Opcode: Start

Event ID 73: DwmpNotifyUserLogoffStop

Channel: Diagnostic
Task: DwmpNotifyUserLogoff
Opcode: Stop

Event ID 101: CreatePrimaryTerminalStart

Channel: Diagnostic
Task: CreatePrimaryTerminal
Opcode: Start

Event ID 102: CreatePrimaryTerminalStop

Channel: Diagnostic
Task: CreatePrimaryTerminal
Opcode: Stop

Event ID 103: StartLogonUIStart

Channel: Diagnostic
Task: StartLogonUI
Opcode: Start

Event ID 104: StartLogonUIStop

Channel: Diagnostic
Task: StartLogonUI
Opcode: Stop

Event ID 105: RunStateMachineStart

Channel: Diagnostic
Task: RunStateMachine
Opcode: Start

Event ID 106: RunStateMachineStop

Channel: Diagnostic
Task: RunStateMachine
Opcode: Stop

Event ID 107: WaitForLSMStart

Channel: Diagnostic
Task: WaitForLSM
Opcode: Start

Event ID 108: WaitForLSMStop

Channel: Diagnostic
Task: WaitForLSM
Opcode: Stop

Event ID 201: DisplayWelcomeScreenStart

Channel: Diagnostic
Task: DisplayWelcomeScreen
Opcode: Start

Event ID 202: DisplayWelcomeScreenStop

Channel: Diagnostic
Task: DisplayWelcomeScreen
Opcode: Stop

Event ID 203: RequestCredentialsStart

Channel: Diagnostic
Task: RequestCredentials
Opcode: Start

Event ID 204: RequestCredentialsStop

Channel: Diagnostic
Task: RequestCredentials
Opcode: Stop

Event ID 205: ThemesOnCreateSessionStart

Channel: Diagnostic
Task: ThemesOnCreateSession
Opcode: Start

Event ID 206: ThemesOnCreateSessionStop

Channel: Diagnostic
Task: ThemesOnCreateSession
Opcode: Stop

Event ID 207: ThemesOnTerminateSessionStart

Channel: Diagnostic
Task: ThemesOnTerminateSession
Opcode: Start

Event ID 208: ThemesOnTerminateSessionStop

Channel: Diagnostic
Task: ThemesOnTerminateSession
Opcode: Stop

Event ID 301: ReceivedLogoffRequest

Channel: Diagnostic
Task: ReceivedLogoffRequest

Fields #

Name	Description
`Flags` UInt32

Event ID 401: ShutdownWindowsStart

Channel: Diagnostic
Task: ShutdownWindows
Opcode: Start

Fields #

Name	Description
`Flags` UInt32

Event ID 402: ShutdownWindowsStop

Channel: Diagnostic
Task: ShutdownWindows
Opcode: Stop

Fields #

Name	Description
`Win32Status` UInt32

Event ID 403: InitiateShutdownStart

Channel: Diagnostic
Task: InitiateShutdown
Opcode: Start

Fields #

Name	Description
`Flags` UInt32

Event ID 404: InitiateShutdownStop

Channel: Diagnostic
Task: InitiateShutdown
Opcode: Stop

Fields #

Name	Description
`Win32Status` UInt32

Event ID 501: WluiServerStartupStart

Channel: Diagnostic
Task: WluiServerStartup
Opcode: Start

Event ID 502: WluiServerStartupStop

Channel: Diagnostic
Task: WluiServerStartup
Opcode: Stop

Event ID 503: WluiServerShutdownStart

Channel: Diagnostic
Task: WluiServerShutdown
Opcode: Start

Event ID 504: WluiServerShutdownStop

Channel: Diagnostic
Task: WluiServerShutdown
Opcode: Stop

Event ID 505: WluiServerStartup

Channel: Operational
Task: WluiServerStartup

Event ID 801: NotifyExecuteStart

Channel: Diagnostic
Task: NotifyExecute
Opcode: Start

Fields #

Name	Description
`Event` UInt32

Event ID 802: NotifyExecuteStop

Channel: Diagnostic
Task: NotifyExecute
Opcode: Stop

Fields #

Name	Description
`Event` UInt32

Event ID 803: NotifyServicesStart

Channel: Diagnostic
Task: NotifyServices
Opcode: Start

Fields #

Name	Description
`EventCode` UInt32
`SessionId` UInt32

Event ID 804: NotifyServicesStop

Channel: Diagnostic
Task: NotifyServices
Opcode: Stop

Fields #

Name	Description
`EventCode` UInt32
`SessionId` UInt32

Event ID 805: NotifySubscriberStart

Channel: Diagnostic
Task: NotifySubscriber
Opcode: Start

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString

Event ID 806: NotifySubscriberStop

Channel: Diagnostic
Task: NotifySubscriber
Opcode: Stop

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString

Event ID 807: NotifySubscriberNotificationPended

Channel: Diagnostic
Task: NotifySubscriber
Opcode: NotificationPended

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString
`Message` UnicodeString

Event ID 808: NotifySubscriberNotificationFailed

Channel: Diagnostic
Task: NotifySubscriber
Opcode: NotificationFailed

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString
`Message` UnicodeString

Event ID 809: ConnectToSubscriberStart

Channel: Diagnostic
Task: ConnectToSubscriber
Opcode: Start

Fields #

Name	Description
`SubscriberName` UnicodeString

Event ID 810: ConnectToSubscriberStop

Channel: Diagnostic
Task: ConnectToSubscriber
Opcode: Stop

Fields #

Name	Description
`SubscriberName` UnicodeString

Event ID 811: The winlogon notification subscriber <SubscriberName> began handling the notification event (Event).

Channel: Operational
Level: Informational
Task: CallSubscriber
Opcode: Start

Message #

The winlogon notification subscriber <%2> began handling the notification event (%1).

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 811,
    "version": 0,
    "level": 4,
    "task": 811,
    "opcode": 1,
    "keywords": 4611686018427453440,
    "time_created": "2026-05-29T16:33:57.4787633+00:00",
    "event_record_id": 553,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 1104
    },
    "channel": "Microsoft-Windows-Winlogon/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Event": "12",
    "SubscriberName": "TermSrv"
  },
  "message": "The winlogon notification subscriber <TermSrv> began handling the notification event (12)."
}

Event ID 812: The winlogon notification subscriber <SubscriberName> finished handling the notification event (Event).

Channel: Operational
Level: Informational
Task: CallSubscriber
Opcode: Stop

Message #

The winlogon notification subscriber <%2> finished handling the notification event (%1).

Fields #

Name	Description
`Event` UInt32
`SubscriberName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 812,
    "version": 0,
    "level": 4,
    "task": 811,
    "opcode": 2,
    "keywords": 4611686018427453440,
    "time_created": "2026-05-29T16:33:57.4792609+00:00",
    "event_record_id": 554,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 1104
    },
    "channel": "Microsoft-Windows-Winlogon/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Event": "12",
    "SubscriberName": "TermSrv"
  },
  "message": "The winlogon notification subscriber <TermSrv> finished handling the notification event (12)."
}

Event ID 1001: Logon hours expiration warning.

Channel: Operational
Task: LogonHours

Fields #

Name	Description
`ActionId` UInt32
`TimeLeft` UInt32

Event ID 1002: The shell stopped unexpectedly and Data_0 was restarted

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 1002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T23:53:34.619082+00:00",
    "event_record_id": 1811,
    "correlation": {},
    "execution": {
      "process_id": 736,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "explorer.exe",
    "Binary": ""
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1002: The shell stopped unexpectedly and %1 was restarted

Channel: Operational
Level: 4

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "event_id": 1002,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-03-15T03:00:56.5858172+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Application"
  },
  "event_data": {}
}

Event ID 1101: The computer will be locked because the user has exceeded the maximum number of failed logon attempts allowed on this computer.

Channel: Operational
Task: EAS

Description

The computer will be locked because the user has exceeded the maximum number of failed logon attempts allowed on this computer. A recovery key is required to unlock the device.

Message #

The computer will be locked because the user has exceeded the maximum number of failed logon attempts allowed on this computer. A recovery key is required to unlock the device.
UserSid: %1 
UserName: %2 
UserDomain: %3

Fields #

Name	Description
`UserSid` SID
`UserName` UnicodeString
`UserDomain` UnicodeString

Event ID 1102: The computer will be rebooted because the user has exceeded the maximum number of failed logon attempts allowed on this computer.

Channel: Operational
Task: EAS

Message #

The computer will be rebooted because the user has exceeded the maximum number of failed logon attempts allowed on this computer.
UserSid: %1 
UserName: %2 
UserDomain: %3

Fields #

Name	Description
`UserSid` SID
`UserName` UnicodeString
`UserDomain` UnicodeString

Event ID 1103: The user is approaching the threshold for maximum number of failed logon attempts.

Channel: Operational
Task: EAS

Description

The user is approaching the threshold for maximum number of failed logon attempts. Once the maximum limit is reached the computer will be locked or rebooted.

Message #

The user is approaching the threshold for maximum number of failed logon attempts. Once the maximum limit is reached the computer will be locked or rebooted.
UserSid: %1 
UserName: %2 
UserDomain: %3

Fields #

Name	Description
`UserSid` SID
`UserName` UnicodeString
`UserDomain` UnicodeString

Event ID 1104: Encryption Provider initialization failed.

Channel: Operational
Task: EAS

Description

Encryption Provider initialization failed. Error Win32Status.

Message #

Encryption Provider initialization failed. Error %1

Fields #

Name	Description
`Win32Status` UInt32

Event ID 4002: The logon hours restriction policy is applied to the logged on user

Channel: Operational

Event ID 4003: The Windows logon process has failed to switch the desktop

Channel: Operational

Event ID 4004: The Windows logon process has failed to terminate the currently logged on user's processes

Channel: Application, Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Winlogon",
    "event_id": 4004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2016-08-21T21:00:34.000000Z",
    "event_record_id": 1596,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4005: The Windows logon process has unexpectedly terminated

Channel: Operational

Event ID 4006: The Windows logon process has failed to spawn a user application

Channel: Operational

Event ID 4007: The Windows logon process has failed to disconnect the user session

Channel: Operational

Event ID 4008: The Windows logon process has failed to connect the user session

Channel: Operational

Event ID 4101: Windows license validated.

Channel: Application
Level: Informational

Fields #

Name	Description
`Data`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Winlogon",
    "event_id": 4101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:51:18+00:00",
    "event_record_id": 232,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "0x00000000",
      "0x00000001"
    ]
  },
  "message": "Windows license validated."
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 4101: Windows license validated

Channel: Operational

Event ID 4102: Windows license is invalid

Channel: Operational

Event ID 4103: Windows license activation failed

Channel: Operational

Event ID 4104: Accessing Windows in Notification period

Channel: Application, Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Winlogon",
    "event_id": 4104,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-21T23:44:00.000000Z",
    "event_record_id": 812,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4105: Windows is in Notification period

Channel: Application, Operational
Level: Warning

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Winlogon",
    "event_id": 4105,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-21T23:43:09.000000Z",
    "event_record_id": 811,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 5001: UserBootStart

Channel: Diagnostic
Task: UserBoot
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 5002: UserBootStop

Channel: Diagnostic
Task: UserBoot
Opcode: Stop

Event ID 5003: UserBoot

Channel: Diagnostic
Task: UserBoot

Fields #

Name	Description
`SessionId` UInt32

Event ID 5005: UserShellLaunch

Channel: Diagnostic
Task: UserShellLaunch

Event ID 5007: SystemBootStop_V2

Channel: Diagnostic
Task: SystemBoot
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`ReadyBootTrainingCountSinceLastServicing` UInt32
`SyncPrefetchErrorCode` UInt32
`SyncPrefetchDurationMs` UInt32

Event ID 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.

Channel: Application
Level: Informational

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:22.560419+00:00",
    "event_record_id": 1545,
    "correlation": {},
    "execution": {
      "process_id": 736,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "SessionEnv"
    ],
    "Binary": "2QYAAA=="
  },
  "message": "The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event."
}

Event ID 6000: The winlogon notification subscriber <Data_0> was unavailable to handle a notification event

Channel: Operational
Level: 4

Fields #

Name	Description
`Data_0`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 6000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T05:22:33.7521344+00:00",
    "event_record_id": 1011,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "WSearch"
  },
  "message": "The winlogon notification subscriber <WSearch> was unavailable to handle a notification event."
}

Event ID 6001: The winlogon notification subscriber <SessionEnv> failed a notification event.

Channel: Application
Level: 3

Fields #

Name	Description
`Flags`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6001,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:09:30.700144+00:00",
    "event_record_id": 146,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-SUBCA",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>SessionEnv</string>\n",
    "Binary": "2QYAAA=="
  },
  "message": "The winlogon notification subscriber <SessionEnv> failed a notification event."
}

Example keys not documented in the fields table: Binary, Data_0

Event ID 6001: The winlogon notification subscriber <Flags> failed a notification event

Channel: Diagnostic
Task: ShutdownDiagnostics
Opcode: Start

Fields #

Name	Description
`Flags` UInt32

Event ID 6002: The winlogon notification subscriber registration database cannot be loaded

Channel: Operational

Event ID 6003: The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.

Channel: Application
Level: Informational

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:20.495672+00:00",
    "event_record_id": 1542,
    "correlation": {},
    "execution": {
      "process_id": 736,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "SessionEnv"
    ],
    "Binary": "2QYAAA=="
  },
  "message": "The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event."
}

Event ID 6003: The winlogon notification subscriber <Data_0> was unavailable to handle a critical notification event

Channel: Operational
Level: 4

Fields #

Name	Description
`Data_0`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 6003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:27:34.0707520+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "SessionEnv"
  },
  "message": "The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event."
}

Event ID 6004: The winlogon notification subscriber <TrustedInstaller> failed a critical notification event.

Channel: Application
Level: Warning

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6004,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:32:12+00:00",
    "event_record_id": 181,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "TrustedInstaller"
    ],
    "Binary": "aQYAAA=="
  },
  "message": "The winlogon notification subscriber <TrustedInstaller> failed a critical notification event."
}

Event ID 6004: The winlogon notification subscriber <Data_0> failed a critical notification event

Channel: Operational
Level: 3

Fields #

Name	Description
`Data_0`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 6004,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T13:42:47.3224679+00:00",
    "event_record_id": 5090,
    "correlation": {},
    "execution": {
      "process_id": 860,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "TrustedInstaller"
  },
  "message": "The winlogon notification subscriber <TrustedInstaller> failed a critical notification event."
}

Event ID 6005: The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession).

Channel: Application
Level: Warning

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6005,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T08:16:03.529427+00:00",
    "event_record_id": 116,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "GPClient",
      "CreateSession"
    ],
    "Binary": "SNCCJg=="
  },
  "message": "The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession)."
}

Event ID 6005: The winlogon notification subscriber <Data_0> is taking long time to handle the notification event (Data_1)

Channel: Operational
Level: 3

Fields #

Name	Description
`Data_0`
`Data_1`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 6005,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-28T22:42:48.5496626+00:00",
    "event_record_id": 619,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "GPClient",
    "Data_1": "CreateSession"
  },
  "message": "The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession)."
}

Event ID 6006: The winlogon notification subscriber <GPClient> took 119 second(s) to handle the notification event (CreateSession).

Channel: Application
Level: Warning

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "Wlclntfy",
    "event_id": 6006,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T08:17:03.466560+00:00",
    "event_record_id": 120,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "GPClient",
      "119",
      "CreateSession"
    ],
    "Binary": "AAAAAA=="
  },
  "message": "The winlogon notification subscriber <GPClient> took 119 second(s) to handle the notification event (CreateSession)."
}

Event ID 6006: The winlogon notification subscriber <Data_0> took Data_1 second(s) to handle the notification event (Data_2)

Channel: Operational
Level: 3

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 6006,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-28T22:42:49.3308868+00:00",
    "event_record_id": 620,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "GPClient",
    "Data_1": "60",
    "Data_2": "CreateSession"
  },
  "message": "The winlogon notification subscriber <GPClient> took 60 second(s) to handle the notification event (CreateSession)."
}

Event ID 6101: LogoffRequestToUserFeedbackStart

Channel: Diagnostic
Task: LogoffRequestToUserFeedback
Opcode: Start

Fields #

Name	Description
`LogoffFlags` UInt32

Event ID 6102: LogoffRequestToUserFeedbackStop

Channel: Diagnostic
Task: LogoffRequestToUserFeedback
Opcode: Stop

Fields #

Name	Description
`Flags` UInt32

Event ID 6103: LogoffAppsTerminationToSessionEndStart

Channel: Diagnostic
Task: LogoffAppsTerminationToSessionEnd
Opcode: Start

Fields #

Name	Description
`LogoffFlags` UInt32

Event ID 6104: LogoffAppsTerminationToSessionEndStop

Channel: Diagnostic
Task: LogoffAppsTerminationToSessionEnd
Opcode: Stop

Fields #

Name	Description
`LogoffFlags` UInt32

Event ID 6105: UnlockStart

Channel: Diagnostic
Task: Unlock
Opcode: Start

Event ID 6106: UnlockStop

Channel: Diagnostic
Task: Unlock
Opcode: Stop

Event ID 6107: UnlockStop6107

Channel: Diagnostic
Task: Unlock
Opcode: Stop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 6108: LogonStart

Channel: Diagnostic
Task: Logon
Opcode: Start

Event ID 6109: LogonStop

Channel: Diagnostic
Task: Logon
Opcode: Stop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 6110: LogonStop6110

Channel: Diagnostic
Task: Logon
Opcode: Stop

Event ID 6111: LogonStop6111

Channel: Diagnostic
Task: Logon
Opcode: Stop

Event ID 6112: LogonStop6112

Channel: Diagnostic
Task: Logon
Opcode: Stop

Event ID 6113: LockStart

Channel: Diagnostic
Task: Lock
Opcode: Start

Event ID 6114: LockStop

Channel: Diagnostic
Task: Lock
Opcode: Stop

Event ID 6115: LockStop6115

Channel: Diagnostic
Task: Lock
Opcode: Stop

Event ID 6116: Logoff

Channel: Diagnostic
Task: Logoff

Fields #

Name	Description
`Duration` UInt32
`ResolverData` UInt32

Event ID 6117: DelayLockDisplayLockScreen

Channel: Diagnostic
Task: DelayLockDisplayLockScreen

Event ID 6118: KillingScreenSaverToLockWorkStation

Channel: Diagnostic
Task: KillingScreenSaverToLockWorkStation

Event ID 6119: AutomaticRestartSignOn

Channel: Diagnostic
Task: AutomaticRestartSignOn

Event ID 6120: HotKeyLockDesktopInvoked

Channel: Diagnostic
Task: HotKeyLockDesktopInvoked

Event ID 6121: PINResetLogon

Channel: Diagnostic
Task: PINResetLogon

Event ID 6122: PINResetUnlock

Channel: Diagnostic
Task: PINResetUnlock

Event ID 6123: AssignedAccessLogon

Channel: Diagnostic
Task: AssignedAccessLogon

Event ID 6124: AssignedAccessUnlock

Channel: Diagnostic
Task: AssignedAccessUnlock

Event ID 7001: User Logon Notification for Customer Experience Improvement Program

Channel: System
Level: Informational
Task: WinSqmUserLogin

Fields #

Name	Description
`TSId` UInt32
`UserSid` SID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 7001,
    "version": 0,
    "level": 4,
    "task": 1101,
    "opcode": 0,
    "keywords": 2305878193585782784,
    "time_created": "2026-05-29T16:33:48.1843872+00:00",
    "event_record_id": 6808,
    "correlation": {},
    "execution": {
      "process_id": 760,
      "thread_id": 1104
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TSId": "1",
    "UserSid": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "User Logon Notification for Customer Experience Improvement Program"
}

Event ID 7002: User Logoff Notification for Customer Experience Improvement Program

Channel: System
Level: Informational
Task: WinSqmUserLogoff

Fields #

Name	Description
`TSId` UInt32
`UserSid` SID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "guid": "{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}",
    "event_source_name": "",
    "event_id": 7002,
    "version": 0,
    "level": 4,
    "task": 1102,
    "opcode": 0,
    "keywords": 2305878193585782784,
    "time_created": "2026-06-13T05:22:33.8971346+00:00",
    "event_record_id": 7354,
    "correlation": {},
    "execution": {
      "process_id": 756,
      "thread_id": 1120
    },
    "channel": "System",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TSId": "1",
    "UserSid": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "User Logoff Notification for Customer Experience Improvement Program"
}

Event ID 1073742826: The shell stopped unexpectedly and %1 was restarted.

Channel: Operational
Level: 4
Opcode: Info

Description

The shell stopped unexpectedly and was restarted.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "event_id": 1002,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-03-15T03:00:56.5858172+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Application"
  },
  "event_data": {}
}

Event ID 1073745826: The logon hours restriction policy is applied to the logged on user.

Channel: Operational
Opcode: Info

Description

The logon hours restriction policy is applied to the logged on user. The user's session has been locked, disconnected or logged off depending on the policy setting. User Name: Domain Name.

Message #

The logon hours restriction policy is applied to the logged on user. The user's session has been locked, disconnected or logged off depending on the policy setting. User Name: %1 Domain Name: %2

Event ID 1073745925: Windows license validated.

Channel: Operational

Event ID 1073745928: Accessing Windows in Notification period.

Channel: Operational

Event ID 2147487654: The Windows logon process has failed to spawn a user application.

Channel: Operational

Description

The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: .

Message #

The Windows logon process has failed to spawn a user application. Application name: %1. Command line parameters: %2.

Event ID 2147487655: The Windows logon process has failed to disconnect the user session.

Channel: Operational

Event ID 2147487656: The Windows logon process has failed to connect the user session.

Channel: Operational

Event ID 2147487753: Windows is in Notification period.

Channel: Operational

Event ID 2147489648: The winlogon notification subscriber <.

Channel: Operational
Level: 4

Description

The winlogon notification subscriber <> was unavailable to handle a notification event.

Message #

The winlogon notification subscriber <%1> was unavailable to handle a notification event.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "event_id": 6000,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-03-14T21:57:32.6042462+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Application"
  },
  "event_data": {}
}

Event ID 2147489649: The winlogon notification subscriber <.

Channel: Operational

Description

The winlogon notification subscriber <> failed a notification event.

Message #

The winlogon notification subscriber <%1> failed a notification event.

Event ID 2147489650: The winlogon notification subscriber registration database cannot be loaded.

Channel: Operational

Description

The winlogon notification subscriber registration database cannot be loaded. Reason: <>.

Message #

The winlogon notification subscriber registration database cannot be loaded. Reason: <%1>.

Event ID 2147489651: The winlogon notification subscriber <.

Channel: Operational

Description

The winlogon notification subscriber <> was unavailable to handle a critical notification event.

Message #

The winlogon notification subscriber <%1> was unavailable to handle a critical notification event.

Event ID 2147489652: The winlogon notification subscriber <.

Channel: Operational

Description

The winlogon notification subscriber <> failed a critical notification event.

Message #

The winlogon notification subscriber <%1> failed a critical notification event.

Event ID 2147489653: The winlogon notification subscriber <.

Channel: Operational
Level: 3

Description

The winlogon notification subscriber <> is taking long time to handle the notification event ().

Message #

The winlogon notification subscriber <%1> is taking long time to handle the notification event (%2).

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "event_id": 6005,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-03-13T19:09:59.4874940+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Application"
  },
  "event_data": {}
}

Event ID 2147489654: The winlogon notification subscriber <.

Channel: Operational
Level: 3

Description

The winlogon notification subscriber <> took second(s) to handle the notification event ().

Message #

The winlogon notification subscriber <%1> took %2 second(s) to handle the notification event (%3).

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Winlogon",
    "event_id": 6006,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-03-13T19:10:07.8783185+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Application"
  },
  "event_data": {}
}

Event ID 3221229475: The Windows logon process has failed to switch the desktop.

Channel: Operational

Event ID 3221229476: The Windows logon process has failed to terminate the currently logged on user's processes.

Channel: Operational

Event ID 3221229477: The Windows logon process has unexpectedly terminated.

Channel: Operational

Event ID 3221229574: Windows license is invalid.

Channel: Operational

Description

Windows license is invalid. Error . Policy Value .

Message #

Windows license is invalid. Error %1. Policy Value %2.

Event ID 3221229575: Windows license activation failed.

Channel: Operational

Description

Windows license activation failed. Error .

Message #

Windows license activation failed. Error %1.

Provenance

ETW provider GUID dbe9b383-7cf3-4331-91cc-a3cb16a3b538

Defined in winlogon.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB