What do the event tags 0-13 mean in Microsoft-Windows-Winlogon/Operationsl.evtx events 811 and 812 mean?

Our company runs Win10 Enterprise systems and remote login using PIV and Pulse Secure. When looking at a user's logon/logoff times, I found codes 811 and 812 have tags associated with these events. The tags numbers are 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 12, & 13. Does anyone happen to know what these tag events are here? Or where I can find a reference to them? Ben N on this forum provided these first 6 entries on 3 Jan 2021: 2=logon (SessionEnv, TermSrv, Profiles, Sens, or GPClient) Any context on these differences? 3=logoff (Dot3svc, Wlansvc, SessionEnv, Profiles, GPClient, TermSrv, Sens) 4=lock (regardless of automatic or manual) (TermSrv, Sens) 5=unlock (TermSrv, Sens) 6=screensaver start 7=screensaver stop

There is minimal text associated with these numbers displayed in the event viewer as seen here: 0: TermSrv, GPClient, TrustedInstaller) 1: TermSrv) 8: SessionEnv, Sens)
9: SessionEnv, Sens) 12: TermSrv, Sens, GPClient, SessionEnv) 13: GPClient, TermSrv)

Any context as to what the codes and the associated text refers to would be GREATLY APPRECIATED.

1 Answer

I've been investigating the same thing myself, as the Microsoft-Windows-Winlogon/Operational logs seem to be a somewhat reliable source to determine user activities such as logon/logoff and locking/unlocking.

Note that I am mostly interested in interactive activity taking place against the console, so my research was focused on that.

I sampled events from a handful of Windows 10 systems running modern build versions. I performed actions such as interactively logging on to the console, locking and unlocking sessions, using the Switch User function, and using Terminal Service commands such as tsdiscon and logoff against user sessions.

As EventID 811 ("began handling the notification event") seems to be consistently followed by an 812 ("finished handling the notification event") in the vast majority of circumstances, I filtered the dataset I was working with to only include Event ID 812.

Events where SYSTEM is the User ID seem to be logged in many situations. I decided to ignore these events, as I was primarily interested in activities performed by end users themselves.

There are multiple values for SubscriberName present in the logs. While I initially assumed that events with a SubscriberName of TermSrv would be of most relevance, this was not always the case. (For example, using tsdiscon against a session generated an event with the relevant UserID value, an Event value of 8 and a SubscriberName of Sens.)

With all that in mind, here are my findings:

• 0 and 1: Are only present when the UserId is NT AUTHORITY\SYSTEM, and are the only distinct values present when the user is local SYSTEM.
• 2 and 12: Logon
• 3 and 13: Logoff
• 4: Session locked
• 5: Session unlocked
• 8: Session suspended to disc (such as when Switch User is selected, or tsdiscon is used).
• 9: Session resumed from disc.