Elastic Windows Event Explorer


Publisher - Microsoft-Windows-User Device Registration

Event ID 351

Message:

Failed to save the Microsoft Passport key information. 
Error: %{ErrorCode} 
Key ID: %{KeyId} 
Attestation level: %{AttLevel} 
AIK status: %{AikStatus} 
Key type: %{KeyType} 
Key name: %{KeyName} 
IDP domain: %{IdpDomain} 
Tenant ID: %{TenantId} 
User email: %{UserEmail}

Event Data:

# Name In Type
Out Type
1 ErrorCode win:Int32 win:Hresult
2 KeyId win:UnicodeString xs:string
3 AttLevel win:UInt64 xs:unsignedLong
4 AikStatus win:UInt64 xs:unsignedLong
5 KeyType win:UInt64 xs:unsignedLong
6 KeyName win:UnicodeString xs:string
7 IdpDomain win:UnicodeString xs:string
8 TenantId win:UnicodeString xs:string
9 UserEmail win:UnicodeString xs:string

Observed Windows Versions:

Version: 0

Fingerprint: RCVPDSISWHHOQ