Event ID 5632

A request was made to authenticate to a wireless network.

A request was made to authenticate to a wireless network.

Subject:
    Security ID:        %2
    Account Name:       %3
    Account Domain:     %4
    Logon ID:       %5

Network Information:
    Name (SSID):        %1
    Interface GUID:     %8
    Local MAC Address:  %7
    Peer MAC Address:   %6

Additional Information:
    Reason Code:        %9 (%10)
    Error Code:       %11
    EAP Reason Code:        %12         
    EAP Root Cause String:      %13
    EAP Error Code:      %14


This event generates when 802.1x authentication attempt was made for wireless network.

It typically generates when network adapter connects to new wireless network.

Auditing:     Conditional


Volume:     LowMedium

Medium to High


Microsoft Documentation

Event ID - 5632



NameFieldInsertion StringOSExample
Name (SSID)SSID%1Any Nokia
Security IDIdentity%2Any redmond.corp.microsoft.com
Account NameSubjectUserName%3Any -
Account DomainSubjectDomainName%4Any -
Logon IDSubjectLogonId%5Any 0x0
Peer MAC AddressPeerMac%6Any 18:64:72:F3:33:91
Local MAC AddressLocalMac%7Any 02:1A:C5:14:59:C9
Interface GUIDIntfGuid%8Any {2BB33827-6BB6-...}
Reason CodeReasonCode%9Any 0x0
Reason CodeReasonText%10Any The operation was successful
Error CodeErrorCode%11Any 0x0
EAP Reason CodeEAPReasonCode%12Any 0x0
EAP Root Cause StringEapRootCauseString%13Any
EAP Error CodeEAPErrorCode%14Any 0x0


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"



LEFT/RIGHT arrow keys for navigation

Back to List