← cd ~/events
// events/300 · Windows Hello
Event ID 300Windows Hello for Business key created and registered
Windows Hello for Business was created and registered with Microsoft Entra ID. Services such as certificate enrolment can trigger off it.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft Azure Device Registration Service |
| Area | Windows Hello |
What to check
Normal; no action needed.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 300 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 300
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Windows Hello events
- Event ID 358: Device ready to enrol in Windows Hello for Business
- Event ID 362: Windows Hello for Business provisioning will not be launched
- Event ID 7001: Windows Hello for Business sign-in error
- Event ID 1021: Client forbidden access to the ugs scope
- Event ID 107: KDC certificate does not have a matched domain name