A newer version of this documentation is available.

Report

Report defines an eventlog or action to perform when a specified condition is fulfilled.

[Report]
01=LoginFailed eventlog [Options]
02=LoginSuccess -action [Options]
03=LoginFailedPKCS11 eventlog [Options]
04=LoginSuccessPKCS11 eventlog [Options]
05=LoginSuccessCREDUI eventlog [Options]
06=LoginSuccessLOGON eventlog [Options]
07=LoginSuccessUNLOCK_WORKSTATION eventlog [Options]

LoginFailed

Get a report if the Plugin, CSP, or KSP login was unsatisfactory.

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

Example 1. eventlog performed at LoginFailed.

[Report]
01=LoginFailed eventlog -application lsass.exe -number {token-number} -result 160 -type 1

LoginSuccess

Get a report if the Plugin, CSP, or KSP login was correct.

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

Example 2. Action performed at LoginSuccess.

[Report]
01=LoginSuccess -action SetLastCertificate -certificate {certificate-thumbprint}

LoginFailedPKCS11

Get a report if the PKCS#11 login was unsatisfactory.

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

LoginSuccessPKCS11

Get a report if the PKCS#11 login was correct.

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

LoginSuccessCREDUI

Get a report if the credential provider login was correct.

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

LoginSuccessLOGON

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.

LoginSuccessUNLOCK_WORKSTATION

Values

Values are eventlog strings or specified actions.

eventlog [Options]: See the report command for eventlog string configurations.
-action [Options]: See the Available actions section for information about action types. The available actions are specified in the Action section.