Event ID lookup
Search 123 event IDs from the Security log, hybrid join and PRT logs, Windows Hello, Intune MDM, Windows LAPS, BitLocker and Entra Connect. Type an ID, a status code such as 0xC000006A or a word.
123 events
-
A user account was created
A new user object was created, on a domain controller for domain accounts or locally on a member server or workstation.
Check: Review who created it (Subject) and check for oddities such as a blank SAM account name, a primary group other than 513 or a password that was never set.
Microsoft source ↗ -
A user account was enabled
A user or computer object was enabled. Computer account events are only logged on domain controllers.
Check: Monitor every 4722 for local accounts on servers and admin workstations, since those rarely change.
Microsoft source ↗ -
An attempt was made to change an account's password
A user tried to change their own password. A failure is logged if the new password breaks policy or, for local accounts, if the old password was wrong.
Check: For high-value accounts or accounts whose password should never change, alert on any 4723 for that target account.
Microsoft source ↗ -
An attempt was made to reset an account's password
An account reset another account's password. A failure is logged if the new password breaks policy, but not if access was denied.
Check: Check the Subject (who did the reset) and alert on resets of admin, service or local accounts.
Microsoft source ↗ -
A user account was disabled
A user or computer object was disabled. Computer account events are only logged on domain controllers.
Check: Alert on high-value accounts and on accounts that should never be disabled, such as service accounts.
Microsoft source ↗ -
A user account was deleted
A user object was deleted.
Check: Check who deleted it and alert on deletion of high-value, service or local accounts.
Microsoft source ↗ -
A user account was changed
A user object was changed; one event is logged per change. Some changes, such as DACL edits, show every attribute as '-'.
Check: Watch critical accounts, and alert when AllowedToDelegateTo is set if delegation changes matter to you.
Microsoft source ↗ -
A user account was locked out
An account hit the lockout threshold. It is logged on domain controllers, member servers and workstations. Caller Computer Name shows the computer the failed logon attempt came from.
Check: Start at the Caller Computer Name to find what is sending bad passwords, and alert when it is a computer the account should not use or one outside your domain.
Microsoft source ↗ -
A computer account was created
A new computer object was created. Logged only on domain controllers.
Check: Monitor if your policy requires tracking computer account creation, for example to spot unexpected domain joins.
Microsoft source ↗ -
A computer account was deleted
A computer object was deleted. Logged only on domain controllers.
Check: Watch for deletion of important computer accounts such as servers, domain controllers and admin workstations.
Microsoft source ↗ -
SID History was added to an account
SID History was added to an account, which normally only happens during a domain migration.
Check: Microsoft gives no specific recommendation; outside a planned domain migration, find out who added it and why.
Microsoft source ↗ -
A user account was unlocked
A locked-out user account was unlocked.
Check: Monitor every 4767 for local accounts, and check the Subject to see who unlocked it.
Microsoft source ↗ -
The name of an account was changed
A user or computer sAMAccountName was changed. Computer account renames are only logged on domain controllers.
Check: For high-value user, computer or local accounts, monitor this event on the Target Account Security ID.
Microsoft source ↗ -
The audit log was cleared
Someone cleared the Windows Security log.
Check: You should rarely see this. Find out who cleared it (Subject) and why, as clearing the log is a common way to cover tracks.
Microsoft source ↗ -
Volume reverted to an unprotected state
The BitLocker volume went back to unprotected, documented alongside 846 and 851 when policy deployment fails.
Check: Fix the underlying failure in 846 or 851, then let the policy reapply.
Microsoft source ↗ -
Normal BitLocker operation event
One of the events Microsoft cites as generated during normal BitLocker drive encryption when Intune policy is working.
Check: None needed. Confirm the recovery key also appears on the device in Entra ID.
Microsoft source ↗ -
Normal BitLocker operation event
One of the events Microsoft cites as generated during normal BitLocker drive encryption when Intune policy is working.
Check: None needed. Confirm the recovery key also appears on the device in Entra ID.
Microsoft source ↗ -
Failed to back up recovery information to Entra ID
BitLocker could not back up the recovery password for the volume to Microsoft Entra ID; documented with error 0x80072f9a.
Check: On Windows 10 1809 this is fixed by the May 21, 2019 update (KB4497934).
Microsoft source ↗1 codes
0x80072f9aSigned-in user cannot read the private key of the provisioning certificate (Windows 10 1809). -
Failed to enable silent encryption
Silent encryption could not be enabled, for example because the device uses legacy BIOS rather than UEFI, or with error 0x80072f9a.
Check: Check BIOS Mode is UEFI in msinfo32. For 0x80072f9a on Windows 10 1809, install the May 2019 update.
Microsoft source ↗1 codes
0x80072f9aSigned-in user cannot read the private key of the provisioning certificate (Windows 10 1809). -
Compatible TPM not found, or bootable media detected
Silent encryption stopped. Either no usable TPM was found (missing or disabled in firmware) or bootable media (CD or DVD) was in the computer.
Check: Check the TPM is present and enabled in firmware (tpm.msc), or remove the bootable media and restart.
Microsoft source ↗ -
WinRE is not configured
Silent encryption failed because the Windows Recovery Environment is not set up.
Check: Check disk partitions, run reagentc /info and reagentc /enable, and check the Windows Boot Loader configuration.
Microsoft source ↗ -
Password changes failed and scheduled for retry
With source Directory Synchronization, lists DNs of users whose password did not sync and will be retried. Microsoft also lists ID 0 among the events that indicate a connectivity problem.
Check: If it persists, check the users are in sync scope and investigate connectivity.
Microsoft source ↗ -
Access to Entra ID denied
Access to Entra ID was denied, documented when the Entra connector credentials were changed outside the wizard.
Check: Re-run the Entra Connect configuration wizard.
Microsoft source ↗ -
Password hash sync manager starting
The password hash synchronisation manager is starting.
Check: Informational.
Microsoft source ↗ -
Password hash sync could not start
Password hash sync failed to start.
Check: Check the ADSync service and re-run the Entra Connect wizard to re-enable password hash sync if needed.
Microsoft source ↗ -
Password hash sync stopped
Password hash sync has stopped.
Check: If unexpected, check whether the server is in staging mode or the service has stopped.
Microsoft source ↗ -
Error during password hash sync for a domain
Password hash sync failed for a domain. Often a DC replication (DRS) RPC error, which the message shows.
Check: Read the exception text. Microsoft treats 611 as a connectivity problem with the named forest; some older RPC errors were fixed by updating the sync tool.
Microsoft source ↗ -
Paused: full sync not completed
The password hash sync agent paused because directory full sync has not yet finished.
Check: Let the full sync complete; password sync then resumes.
Microsoft source ↗ -
Connection to preferred DC failed
Password hash sync could not connect to the preferred domain controller.
Check: Check the preferred DC is up and reachable from the Connect server.
Microsoft source ↗ -
Full password hash sync started for forest
A full password hash sync has started for a forest.
Check: Informational.
Microsoft source ↗ -
Full password hash sync attempt failed
A full password hash sync attempt failed.
Check: Check the preceding events for the cause, then trigger a full sync again once fixed.
Microsoft source ↗ -
Full password hash sync completed for a domain
A full sync cycle finished retrieving passwords from the domain.
Check: Informational.
Microsoft source ↗ -
Full password hash sync completed for a forest
A full sync cycle finished retrieving passwords from the forest.
Check: Informational.
Microsoft source ↗ -
Password hash sync batch started
Password sync started retrieving changed passwords from AD.
Check: Informational.
Microsoft source ↗ -
Password hash sync batch ended
Password sync finished retrieving changed passwords from AD.
Check: Informational.
Microsoft source ↗ -
Error during password hash sync operation
A credential provisioning batch failed, for example 'Password Synchronization has not been activated for this company'.
Check: Check password hash sync is enabled in the tenant and on the connector; re-run the wizard if needed.
Microsoft source ↗ -
Password hash sync heartbeat started
Password sync started telling Entra ID there is nothing to sync. Happens every 30 minutes when no passwords changed.
Check: Informational.
Microsoft source ↗ -
Password hash sync heartbeat ended
Heartbeat finished. Logged every 30 minutes per AD connector when the channel is active and no changes are pending.
Check: No 654 for a connector means the channel is not working; check for 611, 652 or 655.
Microsoft source ↗ -
Error during password hash sync heartbeat
The heartbeat to Entra ID failed, for example sync not activated or the Entra connector credentials are wrong.
Check: Treat as a connectivity or credential problem; re-run the Entra Connect wizard to refresh credentials.
Microsoft source ↗ -
Password change request
A password change was detected and is being sent to Entra ID. Lists the users in the batch (1 to 50).
Check: Use with 657 to follow one user's password through sync.
Microsoft source ↗ -
Password change result
Shows whether each user's password synced (Result: Success or Failed).
Check: For Failed, run the single-object password sync troubleshooter in Entra Connect.
Microsoft source ↗ -
Password hash sync health task failed during ping
The password hash sync health task failed during the heartbeat (ping) operation.
Check: Check connectivity from the Connect server to Entra ID.
Microsoft source ↗ -
Password hash sync manager alive
The password hash sync manager is alive and running.
Check: Informational.
Microsoft source ↗ -
Single object sync task failed
A single-object password sync task failed.
Check: Re-run the single-object troubleshooter and check that user's sync state.
Microsoft source ↗ -
Failed due to SQL deadlock
Password hash sync failed for a domain because of a SQL deadlock.
Check: Usually transient; if it repeats, check SQL health on the Connect server.
Microsoft source ↗ -
MSAL token acquisition via certificate failed
Entra Connect Sync could not authenticate with application-based authentication, for example AADSTS700027 when two sync servers share the same Entra connector account or a server was cloned.
Check: Give each Connect server its own connector account and application registration, then run Repair-ADSyncToolsEntraAppParameters or the wizard.
Microsoft source ↗1 codes
AADSTS700027Certificate used to sign the client assertion is not registered on the application. -
Unexpected error processing a password change notification
The sync server hit an error handling a password change, for example wrong Entra credentials or password sync not activated for the tenant.
Check: Re-run the configuration wizard, and confirm password hash sync is enabled.
Microsoft source ↗ -
A member was added to a security-enabled global group
A member was added to a global security group. Logged on domain controllers only; the fields match event 4732 apart from the group type.
Check: Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.
Microsoft source ↗ -
A member was removed from a security-enabled global group
A member was removed from a global security group. Logged on domain controllers only; the fields match event 4733 apart from the group type.
Check: Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.
Microsoft source ↗ -
A member was added to a security-enabled local group
A member was added to a local security group (or a domain local group on a DC). One event per member added.
Check: Alert on changes to high-value groups such as the built-in Administrators group.
Microsoft source ↗ -
A member was removed from a security-enabled local group
A member was removed from a local security group (or a domain local group on a DC).
Check: Alert on changes to high-value groups such as the built-in Administrators group.
Microsoft source ↗ -
A member was added to a security-enabled universal group
A member was added to a universal security group. Logged on domain controllers only; the fields match event 4732 apart from the group type.
Check: Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.
Microsoft source ↗ -
A member was removed from a security-enabled universal group
A member was removed from a universal security group. Logged on domain controllers only; the fields match event 4733 apart from the group type.
Check: Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.
Microsoft source ↗ -
Hybrid join discover phase error
Logged when the discover phase fails: the device could not read the service connection point (SCP) or fetch discovery data from enterpriseregistration.windows.net.
Check: Check the SCP in AD points to the right tenant, and that the device can reach enterpriseregistration.windows.net in system context through any proxy.
Microsoft source ↗4 codes
0x80072efdWININET_E_CANNOT_CONNECT: could not connect to the server. 0x80072ee2WININET_E_TIMEOUT: network timeout. 0x801c003aDSREG_DISCOVERY_TENANT_NOT_FOUND: SCP has the wrong tenant ID or the tenant has no active subscription. 0x8007000dE_INVALIDDATA: response could not be parsed, often a proxy returning an HTML sign-in page. -
Hybrid join join-phase error
Logged when the join phase fails, with the error code, HTTP status and message returned by the Device Registration Service.
Check: Use the server error code to find the cause. TPM errors here often mean a cleared TPM or a bad sysprep image.
Microsoft source ↗3 codes
0x801c03f2DSREG_E_DIRECTORY_FAILURE: DirectoryError returned by DRS. 0x801c0002DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError returned by DRS. 0x80090016NTE_BAD_KEYSET: TPM keyset missing, for example after the TPM was cleared. -
Cannot read the computer object in Active Directory
Windows could not access its computer object in AD during hybrid join (DSREG_AUTOJOIN_ADCONFIG_READ_FAILED, 0x801c001d). Error 1312 or 1317 points to AD replication problems.
Check: Troubleshoot AD replication. These problems can be transient and the next join attempt may succeed.
Microsoft source ↗3 codes
0x801c001dDSREG_AUTOJOIN_ADCONFIG_READ_FAILED. 1312ERROR_NO_SUCH_LOGON_SESSION. 1317ERROR_NO_SUCH_USER. -
Hybrid join failed (phase and error code)
On Windows 10 builds before 1803, this event records which phase of Microsoft Entra hybrid join failed and the error code.
Check: Note the phase (precheck, discover, authentication or join) and error code, then use the matching section of the hybrid join troubleshooting guide. On newer builds run dsregcmd /status instead.
Microsoft source ↗ -
Hybrid join authentication error
Records the error, sub-error and server error from the authentication phase of hybrid join, typically when getting a token from Entra ID or a federation server (WS-Trust).
Check: Check the federation service supports WS-Trust and its MEX endpoint, and that the device can reach login.microsoftonline.com in system context (including any proxy).
Microsoft source ↗4 codes
0xcaa90017ERROR_ADAL_PROTOCOL_NOT_SUPPORTED: on-premises identity provider does not support WS-Trust. 0xcaa82efdERROR_ADAL_INTERNET_CANNOT_CONNECT: cannot reach login.microsoftonline.com. 0xcaa82f8fERROR_ADAL_INTERNET_SECURE_FAILURE: TLS certificate could not be validated; check clock skew. 0xcaa20003ERROR_ADAL_SERVER_ERROR_INVALID_GRANT: SAML token from the federation server was not accepted. -
Hybrid join failure event
Listed by Microsoft, alongside 304 and 305, as one of the events to check for the phase and error code of a hybrid join failure on older Windows 10 builds.
Check: Read it together with 304 and 305 to get the full failure picture.
Microsoft source ↗ -
Connector service started
The Intune Certificate Connector service started.
Check: Informational.
Microsoft source ↗ -
Connector service stopped
The Intune Certificate Connector service stopped.
Check: If unplanned, restart the service and check the connector server.
Microsoft source ↗ -
Connector certificate renewed
The connector's enrolment certificate renewed successfully.
Check: Informational.
Microsoft source ↗ -
Connector certificate renewal failed
The connector's enrolment certificate failed to renew.
Check: Reinstall the connector.
Microsoft source ↗ -
Retrieve certificate warning
Warning while retrieving the connector enrolment certificate.
Check: Check the diagnostic code in the event details (for example 0x00000403).
Microsoft source ↗ -
Retrieve certificate error
Failed to read the connector enrolment certificate from the registry.
Check: Check the thumbprint in the event and re-enrol the connector.
Microsoft source ↗ -
PKCS certificate issued
A PKCS certificate was issued successfully.
Check: Informational; event shows device, user, CA, template and thumbprint.
Microsoft source ↗ -
PKCS certificate issue failed
A PKCS certificate could not be issued.
Check: Check the diagnostic code; 0x00000400 means the CA is invalid or unreachable.
Microsoft source ↗ -
Certificate revocation failed
The connector failed to revoke a certificate.
Check: Check the CA name in the event and the NDES SVC logs; 0x00000402 means the account lacks revoke rights.
Microsoft source ↗ -
Upload failed
Failed to upload certificate request or revocation data.
Check: Check the Upload State in the event details to see where it failed.
Microsoft source ↗ -
Download failed
Failed to download a signing, client certificate or revocation request.
Check: Check the download details in the event.
Microsoft source ↗ -
CRP rejected a SCEP challenge
The Certificate Registration Point completed but rejected the request.
Check: Check the diagnostic code; 0x00000411 means the challenge expired and the device must get a new one.
Microsoft source ↗ -
CRP failed to verify a SCEP challenge
The Certificate Registration Point could not verify a client challenge.
Check: Check the diagnostic code and the device ID in the event details.
Microsoft source ↗ -
CRP notify failed
The Certificate Registration Point could not finish the notify process.
Check: Verify the connection between the NDES server and the CA.
Microsoft source ↗ -
Auto MDM Enroll: Succeeded
Automatic MDM enrolment (via Group Policy and Entra ID) succeeded.
Check: None needed. If neither 75 nor 76 appears, the enrolment task never ran, so check the EnterpriseMgmt scheduled task and Group Policy.
Microsoft source ↗ -
Auto MDM Enroll: Failed
Automatic MDM enrolment failed. The commonly seen code 0x8018002b means the UPN uses an unverified or non-routable suffix (such as .local) or the MDM user scope is None.
Check: Check the user's UPN suffix is verified in Entra ID and the MDM user scope includes the user. For Autopilot hybrid devices, check whether the associated Entra device was deleted.
Microsoft source ↗1 codes
0x8018002bUnverified or non-routable UPN suffix, or MDM user scope set to None. -
Auto-enrolment task completed
The auto-enrolment task finished. It is logged whether or not enrolment succeeded.
Check: Check events 75 and 76 in the MDM Admin log for the actual outcome.
Microsoft source ↗ -
Auto-enrolment task triggered
The 'Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID' task was triggered.
Check: Shows the task ran, but not whether enrolment worked. Check DeviceManagement-Enterprise-Diagnostics-Provider events 75 and 76 for the result.
Microsoft source ↗ -
SCEP certificate profile received (CspExecute)
The SCEP certificate profile reached the device. Result 0x2ab0003 (DM_S_ACCEPTED_FOR_PROCESSING) is the normal outcome.
Check: If the event is missing, the policy has not arrived: check assignment and last check-in. Any other result code points to the problem; next check the device to NDES communication.
Microsoft source ↗1 codes
0x2ab0003DM_S_ACCEPTED_FOR_PROCESSING: accepted, normal. -
MDM ConfigurationManager: Command failure status
An MDM command for a CSP failed on the device. Microsoft documents it for RemoteWipe doWipe returning 'The request is not supported'.
Check: Read the Provider Name and CSP URI to see which CSP failed. For RemoteWipe, run reagentc /info: the CSP needs Windows RE to be enabled.
Microsoft source ↗ -
MDM ConfigurationManager: CSP Node Operation
Debug-log record of a CSP node being added or changed, for example a VPNv2 profile, with its result.
Check: Turn on Show Analytic and Debug Logs in Event Viewer, then check the Result for the CSP URI you care about.
Microsoft source ↗ -
WiFiConfigurationServiceProvider: Node set value
The Wi-Fi CSP applied a setting from an Intune Wi-Fi profile, with the result.
Check: Confirm the result is 'The operation completed successfully'. If the event is missing, the Wi-Fi profile has not reached the device.
Microsoft source ↗ -
Auto-enrolment task did not start
With error code 2149056522, the auto-enrolment task could not start because the device is already enrolled in another MDM.
Check: Unenrol the device from the other MDM solution, then let the task run again.
Microsoft source ↗1 codes
2149056522Device is already enrolled in another MDM. -
Failed to get the ODJ blob
On the Intune Offline Domain Join connector server: the connector lacked permission to create the computer object for a hybrid Autopilot device.
Check: Delegate Full Control over computer objects on the target OU to the connector server's computer account.
Microsoft source ↗ -
KRB_AP_ERR_MODIFIED from the server
A client presented a service ticket the server could not decrypt. The usual cause is the service principal name (SPN) registered on the wrong account, so users get access denied.
Check: Run setspn -Q <SPN> to find which account holds the SPN, remove it from the wrong account with setspn -D and add it to the right one with setspn -S.
Microsoft source ↗ -
A Kerberos authentication ticket (TGT) was requested
A domain controller handled a request for a Ticket Granting Ticket. A Result Code other than 0x0 means the request failed. Bad passwords (0x18) and smart card PADATA issues (0x10) show up as 4771 instead.
Check: Check the Result Code and Client Address. Flag DES encryption types (0x1, 0x3), pre-authentication type 0 and repeated 0x6 (possible user enumeration).
Microsoft source ↗7 codes
0x6KDC_ERR_C_PRINCIPAL_UNKNOWN: user name not found. 0x7KDC_ERR_S_PRINCIPAL_UNKNOWN: server name not found in Active Directory. 0xCKDC_ERR_POLICY: logon restriction, such as workstation, smart card or logon hours. 0xEKDC_ERR_ETYPE_NOTSUPP: no supported encryption type. 0x12KDC_ERR_CLIENT_REVOKED: account disabled, expired or locked out. 0x17KDC_ERR_KEY_EXPIRED: password has expired. 0x25KRB_AP_ERR_SKEW: clock skew too great between client and DC. -
A Kerberos service ticket was requested
A domain controller handled a request for a service ticket (TGS). A Failure Code other than 0x0 means it failed; 0x20 (ticket expired) is routine and very common.
Check: Look at Ticket Encryption Type: on modern systems expect 0x11 or 0x12 (AES). Investigate DES (0x1, 0x3) and other non-AES types such as RC4 (0x17).
Microsoft source ↗4 codes
0x11AES128-CTS-HMAC-SHA1-96 encryption. 0x12AES256-CTS-HMAC-SHA1-96 encryption. 0x17RC4-HMAC encryption: legacy, should not be needed on Vista/Server 2008 and later. 0x20KRB_AP_ERR_TKT_EXPIRED: ticket expired, informational. -
Kerberos pre-authentication failed
The KDC refused to issue a TGT because pre-authentication failed. Logged only on domain controllers; this is where wrong-password Kerberos failures appear.
Check: A burst of 0x18 for one account suggests password guessing; check the Client Address to find the source. 0x10 usually points at smart card or DC certificate problems.
Microsoft source ↗5 codes
0x10KDC_ERR_PADATA_TYPE_NOSUPP: often a smart card logon problem, such as a missing DC certificate. 0x12KDC_ERR_CLIENT_REVOKED: credentials revoked (disabled, expired or locked). 0x17KDC_ERR_KEY_EXPIRED: password has expired. 0x18KDC_ERR_PREAUTH_FAILED: wrong password. 0x25KRB_AP_ERR_SKEW: clock skew too great. -
LAPS policy processing started
A Windows LAPS background policy processing cycle has started. Every cycle begins with this event.
Check: Read the events that follow up to the matching 10004 or 10005.
Microsoft source ↗ -
LAPS policy processing succeeded
The policy processing cycle finished successfully.
Check: None needed.
Microsoft source ↗ -
LAPS policy processing failed
The policy processing cycle failed and logs an error code, for example 80070032.
Check: Use the error code and the events logged between 10003 and 10005 to find the failing step.
Microsoft source ↗ -
Password backed up to Active Directory
LAPS updated Windows Server Active Directory with the new password.
Check: None needed.
Microsoft source ↗ -
Local account password updated
LAPS updated the managed local account with the new password, after the directory was updated. Shows the account name and RID.
Check: None needed.
Microsoft source ↗ -
Policy configuration: Active Directory backup
Lists the current LAPS policy when backup is to Windows Server AD (source, account, age, complexity, length, encryption and so on).
Check: Use it to confirm which settings the device actually received.
Microsoft source ↗ -
Policy configuration: Microsoft Entra ID backup
Lists the current LAPS policy when backup is to Microsoft Entra ID, including policy source (for example CSP from Intune).
Check: Use it to confirm which settings the device actually received.
Microsoft source ↗ -
Policy configuration: legacy Microsoft LAPS
Windows LAPS is running in legacy Microsoft LAPS emulation mode and lists that policy.
Check: Expected only if you deliberately use legacy LAPS policy; otherwise move to Windows LAPS policy.
Microsoft source ↗ -
Password backed up to Microsoft Entra ID
LAPS updated Microsoft Entra ID with the new password.
Check: None needed. If it is missing, work back through the cycle from 10003 and check for a 10005 failure.
Microsoft source ↗ -
External password change blocked
LAPS blocked an attempt by something other than LAPS to change the managed account's password.
Check: Find out what tried to change it; nothing else should manage this password.
Microsoft source ↗ -
Managed account authentication detected
LAPS saw a successful sign-in with the managed account and scheduled the post-authentication actions after the grace period.
Check: Expected after someone uses the LAPS password; note the reset deadline in the event.
Microsoft source ↗ -
Post-authentication grace period expired
The grace period has ended and the configured post-authentication actions will now run.
Check: None needed.
Microsoft source ↗ -
Post-authentication password reset failed
LAPS could not rotate the password after an authentication event and will keep retrying. Logs the retry count and error code.
Check: Use the error code to troubleshoot, and check the directory backup target is reachable.
Microsoft source ↗ -
Post-authentication password reset succeeded
LAPS rotated the password and completed all post-authentication actions.
Check: None needed.
Microsoft source ↗ -
Unable to set up a secure session with a domain controller
The computer could not build a Netlogon secure channel to a DC. With code 0xC00000E5 (STATUS_INTERNAL_ERROR) on Windows Server 2025 talking to 2022 or 2019 DCs, Microsoft says it is a one-off, harmless event at Netlogon start-up.
Check: If the secure channel comes up afterwards, it can be ignored. If 5719 keeps recurring or carries other codes, troubleshoot DC connectivity and name resolution.
Microsoft source ↗1 codes
0xC00000E5STATUS_INTERNAL_ERROR: expected when a Windows Server 2025 member talks to an older DC. -
PRT acquisition started
In the AAD analytic log, marks the start of the Primary Refresh Token (PRT) acquisition flow at sign-in.
Check: Enable the analytic log, then read every AAD event between 1006 and 1007 as part of the same PRT attempt.
Microsoft source ↗ -
PRT acquisition finished (final error code)
Marks the end of the PRT acquisition flow and logs the final error code.
Check: Look up the final error code (for example 0xc000006d, 0xc000005f or 0xc004844c) in the hybrid join PRT troubleshooting table.
Microsoft source ↗4 codes
0xc000006d / 0xc000006aSTATUS_LOGON_FAILURE / STATUS_WRONG_PASSWORD: cannot reach Entra ID or got HTTP 400 from Entra ID or WS-Trust. 0xc00000d0STATUS_REQUEST_NOT_ACCEPTED: HTTP 400 from Entra ID or WS-Trust. 0xc000005fSTATUS_NO_SUCH_LOGON_SESSION: user realm discovery failed; the UPN suffix may not be a verified domain. 0xc004844cAAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED: UPN is not in the expected format. -
URL being accessed
Analytic event that records the URL CloudAP is calling. The first 1022 before a 1081 or 1088 shows which endpoint failed.
Check: Use it to identify which endpoint (Entra ID, MEX or WS-Trust) returned the error or unexpected response.
Microsoft source ↗ -
Error from the Microsoft Entra authentication service
Contains the server error code and description returned by Entra ID during PRT acquisition, such as AADSTS50155 or AADSTS50126.
Check: Match the AADSTS code: 50155 means device authentication failed (device deleted or disabled), 50126 means bad credentials or a password not yet synced.
Microsoft source ↗ -
Network error reaching an endpoint
Records the URL being accessed when PRT acquisition hits a general network error such as WinHTTP timeout or name not resolved.
Check: Test connectivity to the URL shown, and make sure the computer account can authenticate to any outbound proxy.
Microsoft source ↗4 codes
12002ERROR_WINHTTP_TIMEOUT 12007ERROR_WINHTTP_NAME_NOT_RESOLVED 12029ERROR_WINHTTP_CANNOT_CONNECT 12030ERROR_WINHTTP_CONNECTION_ERROR -
Error from the WS-Trust (federation) endpoint
Contains the server error code and description returned by the on-premises WS-Trust endpoint during federated PRT acquisition.
Check: Check the federation server's WS-Trust endpoints and that no proxy is altering the response.
Microsoft source ↗ -
Token broker operation failed (0xCAA5001C)
Entra authentication through the token broker failed, which can break the Store for Business and Enterprise State Roaming. Caused by missing permissions or ownership on the AAD BrokerPlugin PSR registry key.
Check: Match the SID in the event to HKEY_USERS, take ownership (SYSTEM) of the BrokerPlugin PSR key if needed and re-enable permission inheritance.
Microsoft source ↗1 codes
0xCAA5001CToken broker operation failed. -
UPN provided for sign-in
Analytic event that shows the UPN used for PRT acquisition.
Check: Confirm the UPN suffix is a verified custom domain in Entra ID and is not a non-routable suffix such as .local.
Microsoft source ↗ -
An account was successfully logged on
A logon session was created on the computer that was accessed. The Logon Type field tells you how (2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 Remote Desktop, 11 cached interactive).
Check: Filter on high-value accounts and on Elevated Token = Yes for admin logons. Treat batch (4) or service (5) logons by domain admins, and type 10 logons without Restricted Admin where it is mandated, as worth investigating.
Microsoft source ↗9 codes
2Interactive: signed in at the console. 3Network: for example a file share or remote management. 4Batch: scheduled task or batch server. 5Service: started by the Service Control Manager. 7Unlock: workstation unlocked. 8NetworkCleartext: password passed to the authentication package unhashed. 9NewCredentials: cloned token with new credentials for outbound connections (for example RunAs /netonly). 10RemoteInteractive: Remote Desktop or Terminal Services. 11CachedInteractive: cached credentials, no DC contacted. -
An account failed to log on
Logged on the target computer for any failed logon. The Status and Sub Status fields carry an NTSTATUS code that explains why it failed.
Check: Read the Sub Status first, then check the Logon Type, Workstation Name and Source Network Address. Several 0xC0000064 events in a row can mean username enumeration; repeated 0xC000006A or 0xC000006D against service or admin accounts suggests password guessing.
Microsoft source ↗12 codes
0xC000005ENo logon servers available to service the request. Usually an infrastructure or availability problem. 0xC0000064Misspelled or non-existent user name. 0xC000006ACorrect user name, wrong password. 0xC000006DBad user name or authentication information. 0xC000006FLogon outside the account's permitted hours. 0xC0000070Logon from a workstation the account is not allowed to use. 0xC0000072Account disabled by an administrator. 0xC000015BUser has not been granted the requested logon type (logon right) on this machine. 0xC0000192Netlogon service was not started. 0xC0000193Account has expired. 0xC0000234Account is locked out. The doc notes this is the typical Status value for the event. 0xC0000413Authentication firewall: the account is not allowed to authenticate to this machine. -
An account was logged off
The logon session has ended and no longer exists. It pairs with 4624 through the Logon ID, which is only unique until the next reboot.
Check: Correlate with 4624 on the same Logon ID to work out session length. Expect to see 4647 alongside it when a user logs off normally.
Microsoft source ↗ -
User initiated logoff
The user started the logoff process, so no further user activity can happen in that session. Typical for interactive and Remote Desktop sessions.
Check: Use it with 4634 to tell a deliberate logoff apart from a session that simply ended.
Microsoft source ↗ -
A logon was attempted using explicit credentials
A process tried to log on by explicitly supplying an account's credentials, most often a scheduled task or the RUNAS command.
Check: Look for high-value accounts, use outside working hours, unexpected process names or paths, and network addresses outside your ranges.
Microsoft source ↗ -
Special privileges assigned to new logon
A new logon was given one or more sensitive privileges, such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege or SeTakeOwnershipPrivilege. In practice it marks an administrative logon.
Check: Alert when the account is not SYSTEM, NETWORK SERVICE, LOCAL SERVICE or an expected admin. Search the Privileges field for rights that only a few accounts should hold.
Microsoft source ↗ -
The computer attempted to validate the credentials for an account
An NTLM credential check. It is logged on the computer that owns the credentials: the domain controller for domain accounts, or the local machine for local accounts.
Check: Use the Error Code and Source Workstation to find the cause. Bad user names may mean enumeration; bad passwords and lockouts may mean brute force.
Microsoft source ↗11 codes
0xC0000064User name does not exist. 0xC000006AWrong password. 0xC000006DGeneric logon failure, for example bad credentials or a LAN Manager authentication level mismatch. 0xC000006FOutside permitted logon hours. 0xC0000070Unauthorised workstation. 0xC0000071Password has expired. 0xC0000072Account disabled. 0xC0000193Account has expired. 0xC0000224User must change password at next logon. 0xC0000234Account is locked out. 0xC0000371Local account store has no secret material for the account. -
KDC certificate does not have a matched domain name
The Kerberos client received a domain controller certificate whose names do not match the domain, seen with Entra joined key trust and non-Microsoft CAs. The log is off by default.
Check: Reissue the DC certificates so the subject holds the DC's distinguished name, or the SAN holds the DC FQDN, domain FQDN and NetBIOS name.
Microsoft source ↗1 codes
0xC000006DLogon failure reported with the mismatch. -
Windows Hello for Business key created and registered
Windows Hello for Business was created and registered with Microsoft Entra ID. Services such as certificate enrolment can trigger off it.
Check: Normal; no action needed.
Microsoft source ↗ -
Device ready to enrol in Windows Hello for Business
The prerequisite checks passed and the device is ready for Windows Hello for Business provisioning.
Check: If provisioning still does not start, check the other prerequisite events in the same log or run dsregcmd /status.
Microsoft source ↗ -
Windows Hello for Business provisioning will not be launched
Provisioning is blocked because a prerequisite failed, for example 'User has successfully authenticated to the enterprise STS: No' when device authentication has not succeeded.
Check: If the device was only just domain joined, wait for device authentication. If the check keeps failing, investigate AD FS configuration.
Microsoft source ↗ -
Client forbidden access to the ugs scope
On Windows Server 2019 AD FS, the client is refused the ugs scope on the selfscope resource, which blocks Windows Hello for Business provisioning.
Check: Add a 'ugs' scope description in AD FS, add it to the application permission with Set-AdfsApplicationPermission, restart AD FS and reboot the client. Fixed in Windows Server 1903 and later.
Microsoft source ↗ -
Windows Hello for Business sign-in error
Logon error from Windows Hello for Business. Microsoft documents it with cloud Kerberos trust sign-ins failing on captive-portal Wi-Fi, together with Security 4625 status 0xC000005E.
Check: On captive-portal networks, switch to Airplane mode before signing in, or use another sign-in method such as password.
Microsoft source ↗2 codes
0xC000005ENo logon servers available. 0xC0070022Internal failure code seen with this issue.
No events match.