Every logon, unlock or credential prompt done through CodeB SmartLogin writes one event to the Windows event log CodeB Credential Provider V2: event ID 1100 for success and 1101 for failure. Each event records the action, account, card serial, method, computer, UTC time and result — but never a password or PIN. On shared accounts the card serial shows which person logged on, on which PC and when.
What does the CodeB logon audit record?
The CodeB logon audit writes one event for every logon, unlock or credential prompt performed through CodeB SmartLogin. The events go to the Windows event log CodeB Credential Provider V2, under Applications and Services Logs. This gives a complete, tamper-evident record of who used a PC and when, without any extra agent.
Which event IDs and fields are used?
| Event ID | Meaning |
|---|---|
1100 | Succeeded (Audit Success). |
1101 | Failed (Audit Failure) — includes the Windows status code. |
Each event carries these fields:
| Field | Content |
|---|---|
| Action | Logon, Unlock or Credential prompt. |
| Account | The Windows account that was logged on or unlocked. |
| Card serial | The card (or phone card) serial, or none. |
| Method | Password from card, or certificate / Kerberos. |
| Computer | The PC where it happened. |
| Time | UTC. |
| Result | Success, or failure with the Windows status code. |
How do you collect the events centrally?
The events can be collected from all PCs with Windows Event Forwarding or any SIEM. Filter on the log name CodeB Credential Provider V2 and event IDs 1100 and 1101. Because the record is a standard Windows event, it fits existing log pipelines with no extra agent.
What is never written?
No password and no PIN is ever written to the audit. On shared accounts the card serial is the identifier; for phone cards it is the phone card’s pseudonymous ID, not the employee’s name.
Honest limits
The CodeB audit covers logons, unlocks and credential prompts done through CodeB SmartLogin. Logons through Windows’ own smart-card tile — for example the phone-as-PKI-smart-card path, which runs without any CodeB component on the PC — are recorded in the Windows Security log instead, not in events 1100/1101.
Frequently asked questions
Where are the CodeB logon events?
In the Windows event log CodeB Credential Provider V2, under Applications and Services Logs. Event ID 1100 is a successful logon/unlock, 1101 a failed one.
Can I tell which person used a shared account?
Yes, when each person has their own card enrolled for the shared account. The event records the card serial, so you can see which card — and therefore which person — logged on, on which PC and at what time.
Is any password or PIN written to the log?
No. The audit never records a password or PIN. It records the action, account, card serial, method, computer, UTC time and result only.
How do I forward the events to a SIEM?
Use Windows Event Forwarding or your SIEM’s Windows collector and filter on the log name CodeB Credential Provider V2 and event IDs 1100 and 1101.