← cd ~/events
// events/362 · Windows Hello
Event ID 362Windows Hello for Business provisioning will not be launched
Provisioning is blocked because a prerequisite failed, for example 'User has successfully authenticated to the enterprise STS: No' when device authentication has not succeeded.
| Log | Microsoft-Windows-User Device Registration/Admin |
|---|---|
| Source | Microsoft-Windows-User Device Registration |
| Area | Windows Hello |
What to check
If the device was only just domain joined, wait for device authentication. If the check keeps failing, investigate AD FS configuration.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-User Device Registration/Admin'; Id = 362 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-User Device Registration/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-User Device Registration/Admin" and EventID == 362
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Windows Hello events
- Event ID 358: Device ready to enrol in Windows Hello for Business
- Event ID 300: Windows Hello for Business key created and registered
- Event ID 7001: Windows Hello for Business sign-in error
- Event ID 1021: Client forbidden access to the ugs scope
- Event ID 107: KDC certificate does not have a matched domain name