Event ID 1021Client forbidden access to the ugs scope

What to check

Add a 'ugs' scope description in AD FS, add it to the application permission with Set-AdfsApplicationPermission, restart AD FS and reboot the client. Fixed in Windows Server 1903 and later.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'AD FS/Admin'; Id = 1021 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the AD FS/Admin log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "AD FS/Admin" and EventID == 1021
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Windows Hello events

• Event ID 358: Device ready to enrol in Windows Hello for Business
• Event ID 362: Windows Hello for Business provisioning will not be launched
• Event ID 300: Windows Hello for Business key created and registered
• Event ID 7001: Windows Hello for Business sign-in error
• Event ID 107: KDC certificate does not have a matched domain name

Search all 123 event IDs →