azureblog.co.uk
← cd ~/events
// events/7001 · Windows Hello

Event ID 7001Windows Hello for Business sign-in error

Logon error from Windows Hello for Business. Microsoft documents it with cloud Kerberos trust sign-ins failing on captive-portal Wi-Fi, together with Security 4625 status 0xC000005E.

LogMicrosoft-Windows-HelloForBusiness/Operational
SourceMicrosoft-Windows-HelloForBusiness
AreaWindows Hello

What to check

On captive-portal networks, switch to Airplane mode before signing in, or use another sign-in method such as password.

Codes you'll see in this event

CodeMeaning
0xC000005ENo logon servers available.
0xC0070022Internal failure code seen with this issue.

Find it with PowerShell

Run on the machine that logs it.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-HelloForBusiness/Operational'; Id = 7001 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-HelloForBusiness/Operational log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-HelloForBusiness/Operational" and EventID == 7001
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Windows Hello events

  • Event ID 358: Device ready to enrol in Windows Hello for Business
  • Event ID 362: Windows Hello for Business provisioning will not be launched
  • Event ID 300: Windows Hello for Business key created and registered
  • Event ID 1021: Client forbidden access to the ugs scope
  • Event ID 107: KDC certificate does not have a matched domain name

Search all 123 event IDs →

Sources