Event ID 358Device ready to enrol in Windows Hello for Business

What to check

If provisioning still does not start, check the other prerequisite events in the same log or run dsregcmd /status.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 358 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 358
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Windows Hello events

• Event ID 362: Windows Hello for Business provisioning will not be launched
• Event ID 300: Windows Hello for Business key created and registered
• Event ID 7001: Windows Hello for Business sign-in error
• Event ID 1021: Client forbidden access to the ugs scope
• Event ID 107: KDC certificate does not have a matched domain name

Search all 123 event IDs →