{"generated":"2026-10-18T00:33:42.391Z","source":"https://azureblog.co.uk","count":123,"events":[{"id":4624,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"An account was successfully logged on","meaning":"A logon session was created on the computer that was accessed. The Logon Type field tells you how (2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 Remote Desktop, 11 cached interactive).","action":"Filter on high-value accounts and on Elevated Token = Yes for admin logons. Treat batch (4) or service (5) logons by domain admins, and type 10 logons without Restricted Admin where it is mandated, as worth investigating.","codes":[{"code":"2","meaning":"Interactive: signed in at the console."},{"code":"3","meaning":"Network: for example a file share or remote management."},{"code":"4","meaning":"Batch: scheduled task or batch server."},{"code":"5","meaning":"Service: started by the Service Control Manager."},{"code":"7","meaning":"Unlock: workstation unlocked."},{"code":"8","meaning":"NetworkCleartext: password passed to the authentication package unhashed."},{"code":"9","meaning":"NewCredentials: cloned token with new credentials for outbound connections (for example RunAs /netonly)."},{"code":"10","meaning":"RemoteInteractive: Remote Desktop or Terminal Services."},{"code":"11","meaning":"CachedInteractive: cached credentials, no DC contacted."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624"},{"id":4625,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"An account failed to log on","meaning":"Logged on the target computer for any failed logon. The Status and Sub Status fields carry an NTSTATUS code that explains why it failed.","action":"Read the Sub Status first, then check the Logon Type, Workstation Name and Source Network Address. Several 0xC0000064 events in a row can mean username enumeration; repeated 0xC000006A or 0xC000006D against service or admin accounts suggests password guessing.","codes":[{"code":"0xC000005E","meaning":"No logon servers available to service the request. Usually an infrastructure or availability problem."},{"code":"0xC0000064","meaning":"Misspelled or non-existent user name."},{"code":"0xC000006A","meaning":"Correct user name, wrong password."},{"code":"0xC000006D","meaning":"Bad user name or authentication information."},{"code":"0xC000006F","meaning":"Logon outside the account's permitted hours."},{"code":"0xC0000070","meaning":"Logon from a workstation the account is not allowed to use."},{"code":"0xC0000072","meaning":"Account disabled by an administrator."},{"code":"0xC000015B","meaning":"User has not been granted the requested logon type (logon right) on this machine."},{"code":"0xC0000192","meaning":"Netlogon service was not started."},{"code":"0xC0000193","meaning":"Account has expired."},{"code":"0xC0000234","meaning":"Account is locked out. The doc notes this is the typical Status value for the event."},{"code":"0xC0000413","meaning":"Authentication firewall: the account is not allowed to authenticate to this machine."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625"},{"id":4634,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"An account was logged off","meaning":"The logon session has ended and no longer exists. It pairs with 4624 through the Logon ID, which is only unique until the next reboot.","action":"Correlate with 4624 on the same Logon ID to work out session length. Expect to see 4647 alongside it when a user logs off normally.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634"},{"id":4647,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"User initiated logoff","meaning":"The user started the logoff process, so no further user activity can happen in that session. Typical for interactive and Remote Desktop sessions.","action":"Use it with 4634 to tell a deliberate logoff apart from a session that simply ended.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647"},{"id":4648,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"A logon was attempted using explicit credentials","meaning":"A process tried to log on by explicitly supplying an account's credentials, most often a scheduled task or the RUNAS command.","action":"Look for high-value accounts, use outside working hours, unexpected process names or paths, and network addresses outside your ranges.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4648"},{"id":4672,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"Special privileges assigned to new logon","meaning":"A new logon was given one or more sensitive privileges, such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege or SeTakeOwnershipPrivilege. In practice it marks an administrative logon.","action":"Alert when the account is not SYSTEM, NETWORK SERVICE, LOCAL SERVICE or an expected admin. Search the Privileges field for rights that only a few accounts should hold.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4672"},{"id":4720,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was created","meaning":"A new user object was created, on a domain controller for domain accounts or locally on a member server or workstation.","action":"Review who created it (Subject) and check for oddities such as a blank SAM account name, a primary group other than 513 or a password that was never set.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4720"},{"id":4722,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was enabled","meaning":"A user or computer object was enabled. Computer account events are only logged on domain controllers.","action":"Monitor every 4722 for local accounts on servers and admin workstations, since those rarely change.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4722"},{"id":4723,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"An attempt was made to change an account's password","meaning":"A user tried to change their own password. A failure is logged if the new password breaks policy or, for local accounts, if the old password was wrong.","action":"For high-value accounts or accounts whose password should never change, alert on any 4723 for that target account.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4723"},{"id":4724,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"An attempt was made to reset an account's password","meaning":"An account reset another account's password. A failure is logged if the new password breaks policy, but not if access was denied.","action":"Check the Subject (who did the reset) and alert on resets of admin, service or local accounts.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724"},{"id":4725,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was disabled","meaning":"A user or computer object was disabled. Computer account events are only logged on domain controllers.","action":"Alert on high-value accounts and on accounts that should never be disabled, such as service accounts.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4725"},{"id":4726,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was deleted","meaning":"A user object was deleted.","action":"Check who deleted it and alert on deletion of high-value, service or local accounts.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4726"},{"id":4738,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was changed","meaning":"A user object was changed; one event is logged per change. Some changes, such as DACL edits, show every attribute as '-'.","action":"Watch critical accounts, and alert when AllowedToDelegateTo is set if delegation changes matter to you.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4738"},{"id":4740,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was locked out","meaning":"An account hit the lockout threshold. It is logged on domain controllers, member servers and workstations. Caller Computer Name shows the computer the failed logon attempt came from.","action":"Start at the Caller Computer Name to find what is sending bad passwords, and alert when it is a computer the account should not use or one outside your domain.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740"},{"id":4767,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A user account was unlocked","meaning":"A locked-out user account was unlocked.","action":"Monitor every 4767 for local accounts, and check the Subject to see who unlocked it.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4767"},{"id":4781,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"The name of an account was changed","meaning":"A user or computer sAMAccountName was changed. Computer account renames are only logged on domain controllers.","action":"For high-value user, computer or local accounts, monitor this event on the Target Account Security ID.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4781"},{"id":4765,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"SID History was added to an account","meaning":"SID History was added to an account, which normally only happens during a domain migration.","action":"Microsoft gives no specific recommendation; outside a planned domain migration, find out who added it and why.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4765"},{"id":4741,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A computer account was created","meaning":"A new computer object was created. Logged only on domain controllers.","action":"Monitor if your policy requires tracking computer account creation, for example to spot unexpected domain joins.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741"},{"id":4743,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Accounts","title":"A computer account was deleted","meaning":"A computer object was deleted. Logged only on domain controllers.","action":"Watch for deletion of important computer accounts such as servers, domain controllers and admin workstations.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743"},{"id":4732,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was added to a security-enabled local group","meaning":"A member was added to a local security group (or a domain local group on a DC). One event per member added.","action":"Alert on changes to high-value groups such as the built-in Administrators group.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732"},{"id":4733,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was removed from a security-enabled local group","meaning":"A member was removed from a local security group (or a domain local group on a DC).","action":"Alert on changes to high-value groups such as the built-in Administrators group.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4733"},{"id":4728,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was added to a security-enabled global group","meaning":"A member was added to a global security group. Logged on domain controllers only; the fields match event 4732 apart from the group type.","action":"Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-group-management"},{"id":4729,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was removed from a security-enabled global group","meaning":"A member was removed from a global security group. Logged on domain controllers only; the fields match event 4733 apart from the group type.","action":"Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-group-management"},{"id":4756,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was added to a security-enabled universal group","meaning":"A member was added to a universal security group. Logged on domain controllers only; the fields match event 4732 apart from the group type.","action":"Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-group-management"},{"id":4757,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Groups","title":"A member was removed from a security-enabled universal group","meaning":"A member was removed from a universal security group. Logged on domain controllers only; the fields match event 4733 apart from the group type.","action":"Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-security-group-management"},{"id":4768,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Kerberos","title":"A Kerberos authentication ticket (TGT) was requested","meaning":"A domain controller handled a request for a Ticket Granting Ticket. A Result Code other than 0x0 means the request failed. Bad passwords (0x18) and smart card PADATA issues (0x10) show up as 4771 instead.","action":"Check the Result Code and Client Address. Flag DES encryption types (0x1, 0x3), pre-authentication type 0 and repeated 0x6 (possible user enumeration).","codes":[{"code":"0x6","meaning":"KDC_ERR_C_PRINCIPAL_UNKNOWN: user name not found."},{"code":"0x7","meaning":"KDC_ERR_S_PRINCIPAL_UNKNOWN: server name not found in Active Directory."},{"code":"0xC","meaning":"KDC_ERR_POLICY: logon restriction, such as workstation, smart card or logon hours."},{"code":"0xE","meaning":"KDC_ERR_ETYPE_NOTSUPP: no supported encryption type."},{"code":"0x12","meaning":"KDC_ERR_CLIENT_REVOKED: account disabled, expired or locked out."},{"code":"0x17","meaning":"KDC_ERR_KEY_EXPIRED: password has expired."},{"code":"0x25","meaning":"KRB_AP_ERR_SKEW: clock skew too great between client and DC."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768"},{"id":4769,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Kerberos","title":"A Kerberos service ticket was requested","meaning":"A domain controller handled a request for a service ticket (TGS). A Failure Code other than 0x0 means it failed; 0x20 (ticket expired) is routine and very common.","action":"Look at Ticket Encryption Type: on modern systems expect 0x11 or 0x12 (AES). Investigate DES (0x1, 0x3) and other non-AES types such as RC4 (0x17).","codes":[{"code":"0x11","meaning":"AES128-CTS-HMAC-SHA1-96 encryption."},{"code":"0x12","meaning":"AES256-CTS-HMAC-SHA1-96 encryption."},{"code":"0x17","meaning":"RC4-HMAC encryption: legacy, should not be needed on Vista/Server 2008 and later."},{"code":"0x20","meaning":"KRB_AP_ERR_TKT_EXPIRED: ticket expired, informational."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769"},{"id":4771,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Kerberos","title":"Kerberos pre-authentication failed","meaning":"The KDC refused to issue a TGT because pre-authentication failed. Logged only on domain controllers; this is where wrong-password Kerberos failures appear.","action":"A burst of 0x18 for one account suggests password guessing; check the Client Address to find the source. 0x10 usually points at smart card or DC certificate problems.","codes":[{"code":"0x10","meaning":"KDC_ERR_PADATA_TYPE_NOSUPP: often a smart card logon problem, such as a missing DC certificate."},{"code":"0x12","meaning":"KDC_ERR_CLIENT_REVOKED: credentials revoked (disabled, expired or locked)."},{"code":"0x17","meaning":"KDC_ERR_KEY_EXPIRED: password has expired."},{"code":"0x18","meaning":"KDC_ERR_PREAUTH_FAILED: wrong password."},{"code":"0x25","meaning":"KRB_AP_ERR_SKEW: clock skew too great."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771"},{"id":4776,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Sign-in","title":"The computer attempted to validate the credentials for an account","meaning":"An NTLM credential check. It is logged on the computer that owns the credentials: the domain controller for domain accounts, or the local machine for local accounts.","action":"Use the Error Code and Source Workstation to find the cause. Bad user names may mean enumeration; bad passwords and lockouts may mean brute force.","codes":[{"code":"0xC0000064","meaning":"User name does not exist."},{"code":"0xC000006A","meaning":"Wrong password."},{"code":"0xC000006D","meaning":"Generic logon failure, for example bad credentials or a LAN Manager authentication level mismatch."},{"code":"0xC000006F","meaning":"Outside permitted logon hours."},{"code":"0xC0000070","meaning":"Unauthorised workstation."},{"code":"0xC0000071","meaning":"Password has expired."},{"code":"0xC0000072","meaning":"Account disabled."},{"code":"0xC0000193","meaning":"Account has expired."},{"code":"0xC0000224","meaning":"User must change password at next logon."},{"code":"0xC0000234","meaning":"Account is locked out."},{"code":"0xC0000371","meaning":"Local account store has no secret material for the account."}],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776"},{"id":1102,"log":"Security","provider":"Microsoft-Windows-Security-Auditing","area":"Audit log","title":"The audit log was cleared","meaning":"Someone cleared the Windows Security log.","action":"You should rarely see this. Find out who cleared it (Subject) and why, as clearing the log is a common way to cover tracks.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1102"},{"id":4,"log":"System","provider":"Kerberos","area":"Kerberos","title":"KRB_AP_ERR_MODIFIED from the server","meaning":"A client presented a service ticket the server could not decrypt. The usual cause is the service principal name (SPN) registered on the wrong account, so users get access denied.","action":"Run setspn -Q <SPN> to find which account holds the SPN, remove it from the wrong account with setspn -D and add it to the right one with setspn -S.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-event-4-access-denied"},{"id":5719,"log":"System","provider":"NETLOGON","area":"Netlogon","title":"Unable to set up a secure session with a domain controller","meaning":"The computer could not build a Netlogon secure channel to a DC. With code 0xC00000E5 (STATUS_INTERNAL_ERROR) on Windows Server 2025 talking to 2022 or 2019 DCs, Microsoft says it is a one-off, harmless event at Netlogon start-up.","action":"If the secure channel comes up afterwards, it can be ignored. If 5719 keeps recurring or carries other codes, troubleshoot DC connectivity and name resolution.","codes":[{"code":"0xC00000E5","meaning":"STATUS_INTERNAL_ERROR: expected when a Windows Server 2025 member talks to an older DC."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/event-id-5719-when-netlogon-service-restarts"},{"id":304,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Hybrid join failed (phase and error code)","meaning":"On Windows 10 builds before 1803, this event records which phase of Microsoft Entra hybrid join failed and the error code.","action":"Note the phase (precheck, discover, authentication or join) and error code, then use the matching section of the hybrid join troubleshooting guide. On newer builds run dsregcmd /status instead.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":305,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Hybrid join authentication error","meaning":"Records the error, sub-error and server error from the authentication phase of hybrid join, typically when getting a token from Entra ID or a federation server (WS-Trust).","action":"Check the federation service supports WS-Trust and its MEX endpoint, and that the device can reach login.microsoftonline.com in system context (including any proxy).","codes":[{"code":"0xcaa90017","meaning":"ERROR_ADAL_PROTOCOL_NOT_SUPPORTED: on-premises identity provider does not support WS-Trust."},{"code":"0xcaa82efd","meaning":"ERROR_ADAL_INTERNET_CANNOT_CONNECT: cannot reach login.microsoftonline.com."},{"code":"0xcaa82f8f","meaning":"ERROR_ADAL_INTERNET_SECURE_FAILURE: TLS certificate could not be validated; check clock skew."},{"code":"0xcaa20003","meaning":"ERROR_ADAL_SERVER_ERROR_INVALID_GRANT: SAML token from the federation server was not accepted."}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":307,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Hybrid join failure event","meaning":"Listed by Microsoft, alongside 304 and 305, as one of the events to check for the phase and error code of a hybrid join failure on older Windows 10 builds.","action":"Read it together with 304 and 305 to get the full failure picture.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":201,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Hybrid join discover phase error","meaning":"Logged when the discover phase fails: the device could not read the service connection point (SCP) or fetch discovery data from enterpriseregistration.windows.net.","action":"Check the SCP in AD points to the right tenant, and that the device can reach enterpriseregistration.windows.net in system context through any proxy.","codes":[{"code":"0x80072efd","meaning":"WININET_E_CANNOT_CONNECT: could not connect to the server."},{"code":"0x80072ee2","meaning":"WININET_E_TIMEOUT: network timeout."},{"code":"0x801c003a","meaning":"DSREG_DISCOVERY_TENANT_NOT_FOUND: SCP has the wrong tenant ID or the tenant has no active subscription."},{"code":"0x8007000d","meaning":"E_INVALIDDATA: response could not be parsed, often a proxy returning an HTML sign-in page."}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":204,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Hybrid join join-phase error","meaning":"Logged when the join phase fails, with the error code, HTTP status and message returned by the Device Registration Service.","action":"Use the server error code to find the cause. TPM errors here often mean a cleared TPM or a bad sysprep image.","codes":[{"code":"0x801c03f2","meaning":"DSREG_E_DIRECTORY_FAILURE: DirectoryError returned by DRS."},{"code":"0x801c0002","meaning":"DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError returned by DRS."},{"code":"0x80090016","meaning":"NTE_BAD_KEYSET: TPM keyset missing, for example after the TPM was cleared."}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":220,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Hybrid join","title":"Cannot read the computer object in Active Directory","meaning":"Windows could not access its computer object in AD during hybrid join (DSREG_AUTOJOIN_ADCONFIG_READ_FAILED, 0x801c001d). Error 1312 or 1317 points to AD replication problems.","action":"Troubleshoot AD replication. These problems can be transient and the next join attempt may succeed.","codes":[{"code":"0x801c001d","meaning":"DSREG_AUTOJOIN_ADCONFIG_READ_FAILED."},{"code":"1312","meaning":"ERROR_NO_SUCH_LOGON_SESSION."},{"code":"1317","meaning":"ERROR_NO_SUCH_USER."}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1006,"log":"Microsoft-Windows-AAD/Analytic","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"PRT acquisition started","meaning":"In the AAD analytic log, marks the start of the Primary Refresh Token (PRT) acquisition flow at sign-in.","action":"Enable the analytic log, then read every AAD event between 1006 and 1007 as part of the same PRT attempt.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1007,"log":"Microsoft-Windows-AAD/Analytic","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"PRT acquisition finished (final error code)","meaning":"Marks the end of the PRT acquisition flow and logs the final error code.","action":"Look up the final error code (for example 0xc000006d, 0xc000005f or 0xc004844c) in the hybrid join PRT troubleshooting table.","codes":[{"code":"0xc000006d / 0xc000006a","meaning":"STATUS_LOGON_FAILURE / STATUS_WRONG_PASSWORD: cannot reach Entra ID or got HTTP 400 from Entra ID or WS-Trust."},{"code":"0xc00000d0","meaning":"STATUS_REQUEST_NOT_ACCEPTED: HTTP 400 from Entra ID or WS-Trust."},{"code":"0xc000005f","meaning":"STATUS_NO_SUCH_LOGON_SESSION: user realm discovery failed; the UPN suffix may not be a verified domain."},{"code":"0xc004844c","meaning":"AAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED: UPN is not in the expected format."}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1081,"log":"Microsoft-Windows-AAD/Operational","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"Error from the Microsoft Entra authentication service","meaning":"Contains the server error code and description returned by Entra ID during PRT acquisition, such as AADSTS50155 or AADSTS50126.","action":"Match the AADSTS code: 50155 means device authentication failed (device deleted or disabled), 50126 means bad credentials or a password not yet synced.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1088,"log":"Microsoft-Windows-AAD/Operational","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"Error from the WS-Trust (federation) endpoint","meaning":"Contains the server error code and description returned by the on-premises WS-Trust endpoint during federated PRT acquisition.","action":"Check the federation server's WS-Trust endpoints and that no proxy is altering the response.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1084,"log":"Microsoft-Windows-AAD/Operational","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"Network error reaching an endpoint","meaning":"Records the URL being accessed when PRT acquisition hits a general network error such as WinHTTP timeout or name not resolved.","action":"Test connectivity to the URL shown, and make sure the computer account can authenticate to any outbound proxy.","codes":[{"code":"12002","meaning":"ERROR_WINHTTP_TIMEOUT"},{"code":"12007","meaning":"ERROR_WINHTTP_NAME_NOT_RESOLVED"},{"code":"12029","meaning":"ERROR_WINHTTP_CANNOT_CONNECT"},{"code":"12030","meaning":"ERROR_WINHTTP_CONNECTION_ERROR"}],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1022,"log":"Microsoft-Windows-AAD/Analytic","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"URL being accessed","meaning":"Analytic event that records the URL CloudAP is calling. The first 1022 before a 1081 or 1088 shows which endpoint failed.","action":"Use it to identify which endpoint (Entra ID, MEX or WS-Trust) returned the error or unexpected response.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1144,"log":"Microsoft-Windows-AAD/Analytic","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"UPN provided for sign-in","meaning":"Analytic event that shows the UPN used for PRT acquisition.","action":"Confirm the UPN suffix is a verified custom domain in Entra ID and is not a non-routable suffix such as .local.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current"},{"id":1098,"log":"Microsoft-Windows-AAD/Operational","provider":"Microsoft-Windows-AAD","area":"Primary Refresh Token","title":"Token broker operation failed (0xCAA5001C)","meaning":"Entra authentication through the token broker failed, which can break the Store for Business and Enterprise State Roaming. Caused by missing permissions or ownership on the AAD BrokerPlugin PSR registry key.","action":"Match the SID in the event to HKEY_USERS, take ownership (SYSTEM) of the BrokerPlugin PSR key if needed and re-enable permission inheritance.","codes":[{"code":"0xCAA5001C","meaning":"Token broker operation failed."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/user-profiles-and-logon/event-1098-error-0xcaa5001c"},{"id":358,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Windows Hello","title":"Device ready to enrol in Windows Hello for Business","meaning":"The prerequisite checks passed and the device is ready for Windows Hello for Business provisioning.","action":"If provisioning still does not start, check the other prerequisite events in the same log or run dsregcmd /status.","codes":[],"source":"https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll"},{"id":362,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft-Windows-User Device Registration","area":"Windows Hello","title":"Windows Hello for Business provisioning will not be launched","meaning":"Provisioning is blocked because a prerequisite failed, for example 'User has successfully authenticated to the enterprise STS: No' when device authentication has not succeeded.","action":"If the device was only just domain joined, wait for device authentication. If the check keeps failing, investigate AD FS configuration.","codes":[],"source":"https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-issues"},{"id":300,"log":"Microsoft-Windows-User Device Registration/Admin","provider":"Microsoft Azure Device Registration Service","area":"Windows Hello","title":"Windows Hello for Business key created and registered","meaning":"Windows Hello for Business was created and registered with Microsoft Entra ID. Services such as certificate enrolment can trigger off it.","action":"Normal; no action needed.","codes":[],"source":"https://learn.microsoft.com/en-us/previous-versions/troubleshoot/windows-client/event-id-300-windows-hello-successfully-created-in-windows-10"},{"id":7001,"log":"Microsoft-Windows-HelloForBusiness/Operational","provider":"Microsoft-Windows-HelloForBusiness","area":"Windows Hello","title":"Windows Hello for Business sign-in error","meaning":"Logon error from Windows Hello for Business. Microsoft documents it with cloud Kerberos trust sign-ins failing on captive-portal Wi-Fi, together with Security 4625 status 0xC000005E.","action":"On captive-portal networks, switch to Airplane mode before signing in, or use another sign-in method such as password.","codes":[{"code":"0xC000005E","meaning":"No logon servers available."},{"code":"0xC0070022","meaning":"Internal failure code seen with this issue."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/user-profiles-and-logon/whfb-cloud-trust-login-failure"},{"id":1021,"log":"AD FS/Admin","provider":"AD FS","area":"Windows Hello","title":"Client forbidden access to the ugs scope","meaning":"On Windows Server 2019 AD FS, the client is refused the ugs scope on the selfscope resource, which blocks Windows Hello for Business provisioning.","action":"Add a 'ugs' scope description in AD FS, add it to the application permission with Set-AdfsApplicationPermission, restart AD FS and reboot the client. Fixed in Windows Server 1903 and later.","codes":[],"source":"https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-issues"},{"id":107,"log":"Microsoft-Windows-Kerberos/Operational","provider":"Microsoft-Windows-Security-Kerberos","area":"Windows Hello","title":"KDC certificate does not have a matched domain name","meaning":"The Kerberos client received a domain controller certificate whose names do not match the domain, seen with Entra joined key trust and non-Microsoft CAs. The log is off by default.","action":"Reissue the DC certificates so the subject holds the DC's distinguished name, or the SAN holds the DC FQDN, domain FQDN and NetBIOS name.","codes":[{"code":"0xC000006D","meaning":"Logon failure reported with the mismatch."}],"source":"https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-issues"},{"id":75,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin","provider":"DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"Auto MDM Enroll: Succeeded","meaning":"Automatic MDM enrolment (via Group Policy and Entra ID) succeeded.","action":"None needed. If neither 75 nor 76 appears, the enrolment task never ran, so check the EnterpriseMgmt scheduled task and Group Policy.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment"},{"id":76,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin","provider":"DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"Auto MDM Enroll: Failed","meaning":"Automatic MDM enrolment failed. The commonly seen code 0x8018002b means the UPN uses an unverified or non-routable suffix (such as .local) or the MDM user scope is None.","action":"Check the user's UPN suffix is verified in Entra ID and the MDM user scope includes the user. For Autopilot hybrid devices, check whether the associated Entra device was deleted.","codes":[{"code":"0x8018002b","meaning":"Unverified or non-routable UPN suffix, or MDM user scope set to None."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors"},{"id":306,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin","provider":"DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"SCEP certificate profile received (CspExecute)","meaning":"The SCEP certificate profile reached the device. Result 0x2ab0003 (DM_S_ACCEPTED_FOR_PROCESSING) is the normal outcome.","action":"If the event is missing, the policy has not arrived: check assignment and last check-in. Any other result code points to the problem; next check the device to NDES communication.","codes":[{"code":"0x2ab0003","meaning":"DM_S_ACCEPTED_FOR_PROCESSING: accepted, normal."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-scep-certificate-profile-deployment"},{"id":400,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin","provider":"DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"MDM ConfigurationManager: Command failure status","meaning":"An MDM command for a CSP failed on the device. Microsoft documents it for RemoteWipe doWipe returning 'The request is not supported'.","action":"Read the Provider Name and CSP URI to see which CSP failed. For RemoteWipe, run reagentc /info: the CSP needs Windows RE to be enabled.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-management/remotewipe-fails-sending-dowipe-command"},{"id":401,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug","provider":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"MDM ConfigurationManager: CSP Node Operation","meaning":"Debug-log record of a CSP node being added or changed, for example a VPNv2 profile, with its result.","action":"Turn on Show Analytic and Debug Logs in Event Viewer, then check the Result for the CSP URI you care about.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-configuration/troubleshoot-vpn-profiles"},{"id":1506,"log":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin","provider":"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider","area":"Intune MDM","title":"WiFiConfigurationServiceProvider: Node set value","meaning":"The Wi-Fi CSP applied a setting from an Intune Wi-Fi profile, with the result.","action":"Confirm the result is 'The operation completed successfully'. If the event is missing, the Wi-Fi profile has not reached the device.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-configuration/troubleshoot-wi-fi-profiles"},{"id":107,"log":"Microsoft-Windows-TaskScheduler/Operational","provider":"Microsoft-Windows-TaskScheduler","area":"Intune MDM","title":"Auto-enrolment task triggered","meaning":"The 'Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID' task was triggered.","action":"Shows the task ran, but not whether enrolment worked. Check DeviceManagement-Enterprise-Diagnostics-Provider events 75 and 76 for the result.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment"},{"id":102,"log":"Microsoft-Windows-TaskScheduler/Operational","provider":"Microsoft-Windows-TaskScheduler","area":"Intune MDM","title":"Auto-enrolment task completed","meaning":"The auto-enrolment task finished. It is logged whether or not enrolment succeeded.","action":"Check events 75 and 76 in the MDM Admin log for the actual outcome.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment"},{"id":7016,"log":"Microsoft-Windows-TaskScheduler/Operational","provider":"Microsoft-Windows-TaskScheduler","area":"Intune MDM","title":"Auto-enrolment task did not start","meaning":"With error code 2149056522, the auto-enrolment task could not start because the device is already enrolled in another MDM.","action":"Unenrol the device from the other MDM solution, then let the task run again.","codes":[{"code":"2149056522","meaning":"Device is already enrolled in another MDM."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment"},{"id":30132,"log":"ODJ Connector Service","provider":"ODJ Connector Service Source","area":"Intune MDM","title":"Failed to get the ODJ blob","meaning":"On the Intune Offline Domain Join connector server: the connector lacked permission to create the computer object for a hybrid Autopilot device.","action":"Delegate Full Control over computer objects on the target OU to the connector server's computer account.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors"},{"id":10010,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Connector service started","meaning":"The Intune Certificate Connector service started.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10020,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Connector service stopped","meaning":"The Intune Certificate Connector service stopped.","action":"If unplanned, restart the service and check the connector server.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10100,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Connector certificate renewed","meaning":"The connector's enrolment certificate renewed successfully.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10102,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Connector certificate renewal failed","meaning":"The connector's enrolment certificate failed to renew.","action":"Reinstall the connector.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10301,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Retrieve certificate warning","meaning":"Warning while retrieving the connector enrolment certificate.","action":"Check the diagnostic code in the event details (for example 0x00000403).","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10302,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Retrieve certificate error","meaning":"Failed to read the connector enrolment certificate from the registry.","action":"Check the thumbprint in the event and re-enrol the connector.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20100,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"PKCS certificate issued","meaning":"A PKCS certificate was issued successfully.","action":"Informational; event shows device, user, CA, template and thumbprint.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20102,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"PKCS certificate issue failed","meaning":"A PKCS certificate could not be issued.","action":"Check the diagnostic code; 0x00000400 means the CA is invalid or unreachable.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20202,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Certificate revocation failed","meaning":"The connector failed to revoke a certificate.","action":"Check the CA name in the event and the NDES SVC logs; 0x00000402 means the account lacks revoke rights.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20302,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Upload failed","meaning":"Failed to upload certificate request or revocation data.","action":"Check the Upload State in the event details to see where it failed.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20402,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"Download failed","meaning":"Failed to download a signing, client certificate or revocation request.","action":"Check the download details in the event.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20501,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"CRP rejected a SCEP challenge","meaning":"The Certificate Registration Point completed but rejected the request.","action":"Check the diagnostic code; 0x00000411 means the challenge expired and the device must get a new one.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20502,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"CRP failed to verify a SCEP challenge","meaning":"The Certificate Registration Point could not verify a client challenge.","action":"Check the diagnostic code and the device ID in the event details.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":20602,"log":"Microsoft Intune Connector","provider":"Microsoft Intune Connector","area":"Intune connector","title":"CRP notify failed","meaning":"The Certificate Registration Point could not finish the notify process.","action":"Verify the connection between the NDES server and the CA.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-certificate-connector-events"},{"id":10003,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"LAPS policy processing started","meaning":"A Windows LAPS background policy processing cycle has started. Every cycle begins with this event.","action":"Read the events that follow up to the matching 10004 or 10005.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10004,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"LAPS policy processing succeeded","meaning":"The policy processing cycle finished successfully.","action":"None needed.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10005,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"LAPS policy processing failed","meaning":"The policy processing cycle failed and logs an error code, for example 80070032.","action":"Use the error code and the events logged between 10003 and 10005 to find the failing step.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10018,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Password backed up to Active Directory","meaning":"LAPS updated Windows Server Active Directory with the new password.","action":"None needed.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10029,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Password backed up to Microsoft Entra ID","meaning":"LAPS updated Microsoft Entra ID with the new password.","action":"None needed. If it is missing, work back through the cycle from 10003 and check for a 10005 failure.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10020,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Local account password updated","meaning":"LAPS updated the managed local account with the new password, after the directory was updated. Shows the account name and RID.","action":"None needed.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10021,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Policy configuration: Active Directory backup","meaning":"Lists the current LAPS policy when backup is to Windows Server AD (source, account, age, complexity, length, encryption and so on).","action":"Use it to confirm which settings the device actually received.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10022,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Policy configuration: Microsoft Entra ID backup","meaning":"Lists the current LAPS policy when backup is to Microsoft Entra ID, including policy source (for example CSP from Intune).","action":"Use it to confirm which settings the device actually received.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10023,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Policy configuration: legacy Microsoft LAPS","meaning":"Windows LAPS is running in legacy Microsoft LAPS emulation mode and lists that policy.","action":"Expected only if you deliberately use legacy LAPS policy; otherwise move to Windows LAPS policy.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10031,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"External password change blocked","meaning":"LAPS blocked an attempt by something other than LAPS to change the managed account's password.","action":"Find out what tried to change it; nothing else should manage this password.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10041,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Managed account authentication detected","meaning":"LAPS saw a successful sign-in with the managed account and scheduled the post-authentication actions after the grace period.","action":"Expected after someone uses the LAPS password; note the reset deadline in the event.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10042,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Post-authentication grace period expired","meaning":"The grace period has ended and the configured post-authentication actions will now run.","action":"None needed.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10043,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Post-authentication password reset failed","meaning":"LAPS could not rotate the password after an authentication event and will keep retrying. Logs the retry count and error code.","action":"Use the error code to troubleshoot, and check the directory backup target is reachable.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":10044,"log":"Microsoft-Windows-LAPS/Operational","provider":"Microsoft-Windows-LAPS","area":"LAPS","title":"Post-authentication password reset succeeded","meaning":"LAPS rotated the password and completed all post-authentication actions.","action":"None needed.","codes":[],"source":"https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log"},{"id":853,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Compatible TPM not found, or bootable media detected","meaning":"Silent encryption stopped. Either no usable TPM was found (missing or disabled in firmware) or bootable media (CD or DVD) was in the computer.","action":"Check the TPM is present and enabled in firmware (tpm.msc), or remove the bootable media and restart.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":854,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"WinRE is not configured","meaning":"Silent encryption failed because the Windows Recovery Environment is not set up.","action":"Check disk partitions, run reagentc /info and reagentc /enable, and check the Windows Boot Loader configuration.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":851,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Failed to enable silent encryption","meaning":"Silent encryption could not be enabled, for example because the device uses legacy BIOS rather than UEFI, or with error 0x80072f9a.","action":"Check BIOS Mode is UEFI in msinfo32. For 0x80072f9a on Windows 10 1809, install the May 2019 update.","codes":[{"code":"0x80072f9a","meaning":"Signed-in user cannot read the private key of the provisioning certificate (Windows 10 1809)."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":846,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Failed to back up recovery information to Entra ID","meaning":"BitLocker could not back up the recovery password for the volume to Microsoft Entra ID; documented with error 0x80072f9a.","action":"On Windows 10 1809 this is fixed by the May 21, 2019 update (KB4497934).","codes":[{"code":"0x80072f9a","meaning":"Signed-in user cannot read the private key of the provisioning certificate (Windows 10 1809)."}],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":778,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Volume reverted to an unprotected state","meaning":"The BitLocker volume went back to unprotected, documented alongside 846 and 851 when policy deployment fails.","action":"Fix the underlying failure in 846 or 851, then let the policy reapply.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":796,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Normal BitLocker operation event","meaning":"One of the events Microsoft cites as generated during normal BitLocker drive encryption when Intune policy is working.","action":"None needed. Confirm the recovery key also appears on the device in Entra ID.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":845,"log":"Microsoft-Windows-BitLocker/BitLocker Management","provider":"Microsoft-Windows-BitLocker-API","area":"BitLocker","title":"Normal BitLocker operation event","meaning":"One of the events Microsoft cites as generated during normal BitLocker drive encryption when Intune policy is working.","action":"None needed. Confirm the recovery key also appears on the device in Entra ID.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues"},{"id":601,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync manager starting","meaning":"The password hash synchronisation manager is starting.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":607,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync could not start","meaning":"Password hash sync failed to start.","action":"Check the ADSync service and re-run the Entra Connect wizard to re-enable password hash sync if needed.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":609,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync stopped","meaning":"Password hash sync has stopped.","action":"If unexpected, check whether the server is in staging mode or the service has stopped.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":611,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Error during password hash sync for a domain","meaning":"Password hash sync failed for a domain. Often a DC replication (DRS) RPC error, which the message shows.","action":"Read the exception text. Microsoft treats 611 as a connectivity problem with the named forest; some older RPC errors were fixed by updating the sync tool.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":613,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Paused: full sync not completed","meaning":"The password hash sync agent paused because directory full sync has not yet finished.","action":"Let the full sync complete; password sync then resumes.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":616,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Connection to preferred DC failed","meaning":"Password hash sync could not connect to the preferred domain controller.","action":"Check the preferred DC is up and reachable from the Connect server.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":617,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Full password hash sync started for forest","meaning":"A full password hash sync has started for a forest.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":621,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Full password hash sync attempt failed","meaning":"A full password hash sync attempt failed.","action":"Check the preceding events for the cause, then trigger a full sync again once fixed.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":622,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Full password hash sync completed for a domain","meaning":"A full sync cycle finished retrieving passwords from the domain.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":623,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Full password hash sync completed for a forest","meaning":"A full sync cycle finished retrieving passwords from the forest.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":650,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync batch started","meaning":"Password sync started retrieving changed passwords from AD.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":651,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync batch ended","meaning":"Password sync finished retrieving changed passwords from AD.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":652,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Error during password hash sync operation","meaning":"A credential provisioning batch failed, for example 'Password Synchronization has not been activated for this company'.","action":"Check password hash sync is enabled in the tenant and on the connector; re-run the wizard if needed.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":653,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync heartbeat started","meaning":"Password sync started telling Entra ID there is nothing to sync. Happens every 30 minutes when no passwords changed.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":654,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync heartbeat ended","meaning":"Heartbeat finished. Logged every 30 minutes per AD connector when the channel is active and no changes are pending.","action":"No 654 for a connector means the channel is not working; check for 611, 652 or 655.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":655,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Error during password hash sync heartbeat","meaning":"The heartbeat to Entra ID failed, for example sync not activated or the Entra connector credentials are wrong.","action":"Treat as a connectivity or credential problem; re-run the Entra Connect wizard to refresh credentials.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":656,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password change request","meaning":"A password change was detected and is being sent to Entra ID. Lists the users in the batch (1 to 50).","action":"Use with 657 to follow one user's password through sync.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":657,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password change result","meaning":"Shows whether each user's password synced (Result: Success or Failed).","action":"For Failed, run the single-object password sync troubleshooter in Entra Connect.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":662,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync health task failed during ping","meaning":"The password hash sync health task failed during the heartbeat (ping) operation.","action":"Check connectivity from the Connect server to Entra ID.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":663,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password hash sync manager alive","meaning":"The password hash sync manager is alive and running.","action":"Informational.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":664,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Single object sync task failed","meaning":"A single-object password sync task failed.","action":"Re-run the single-object troubleshooter and check that user's sync state.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":666,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Failed due to SQL deadlock","meaning":"Password hash sync failed for a domain because of a SQL deadlock.","action":"Usually transient; if it repeats, check SQL health on the Connect server.","codes":[],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-password-hash-synchronization"},{"id":0,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Password changes failed and scheduled for retry","meaning":"With source Directory Synchronization, lists DNs of users whose password did not sync and will be retried. Microsoft also lists ID 0 among the events that indicate a connectivity problem.","action":"If it persists, check the users are in sync scope and investigate connectivity.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":115,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Access to Entra ID denied","meaning":"Access to Entra ID was denied, documented when the Entra connector credentials were changed outside the wizard.","action":"Re-run the Entra Connect configuration wizard.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":6900,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"Unexpected error processing a password change notification","meaning":"The sync server hit an error handling a password change, for example wrong Entra credentials or password sync not activated for the tenant.","action":"Re-run the configuration wizard, and confirm password hash sync is enabled.","codes":[],"source":"https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/troubleshoot-pwd-sync"},{"id":906,"log":"Application","provider":"Directory Synchronization","area":"Entra Connect","title":"MSAL token acquisition via certificate failed","meaning":"Entra Connect Sync could not authenticate with application-based authentication, for example AADSTS700027 when two sync servers share the same Entra connector account or a server was cloned.","action":"Give each Connect server its own connector account and application registration, then run Repair-ADSyncToolsEntraAppParameters or the wizard.","codes":[{"code":"AADSTS700027","meaning":"Certificate used to sign the client assertion is not registered on the application."}],"source":"https://learn.microsoft.com/en-us/entra/identity/hybrid/troubleshoot-connect-sync-application-authentication"}]}