azureblog.co.uk
← cd ~/events
// events/1007 · Primary Refresh Token

Event ID 1007PRT acquisition finished (final error code)

Marks the end of the PRT acquisition flow and logs the final error code.

LogMicrosoft-Windows-AAD/Analytic
SourceMicrosoft-Windows-AAD
AreaPrimary Refresh Token

What to check

Look up the final error code (for example 0xc000006d, 0xc000005f or 0xc004844c) in the hybrid join PRT troubleshooting table.

Codes you'll see in this event

CodeMeaning
0xc000006d / 0xc000006aSTATUS_LOGON_FAILURE / STATUS_WRONG_PASSWORD: cannot reach Entra ID or got HTTP 400 from Entra ID or WS-Trust.
0xc00000d0STATUS_REQUEST_NOT_ACCEPTED: HTTP 400 from Entra ID or WS-Trust.
0xc000005fSTATUS_NO_SUCH_LOGON_SESSION: user realm discovery failed; the UPN suffix may not be a verified domain.
0xc004844cAAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED: UPN is not in the expected format.

Find it with PowerShell

Run on the machine that logs it. Analytic and Debug logs are hidden and turned off by default: in Event Viewer choose View › Show Analytic and Debug Logs, then enable the log.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Analytic'; Id = 1007 } -Oldest -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-AAD/Analytic log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-AAD/Analytic" and EventID == 1007
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Primary Refresh Token events

Search all 123 event IDs →

Sources