Windows Event ID 1101 – Winlogon: User Logon Notification for Customer Experience Improvement Program

Open Event Viewer to examine the specific details of Event ID 1101 occurrences:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Application
3. In the Actions pane, click Filter Current Log
4. Enter 1101 in the Event IDs field and click OK
5. Double-click any Event ID 1101 entry to view detailed information
6. Review the General tab for event description and the Details tab for XML data
7. Note the User SID, Process ID, and any additional context information

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1101} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Analyze Event ID 1101 patterns to understand user behavior and system usage:

1. Create a PowerShell script to track logon frequency:

$StartTime = (Get-Date).AddDays(-7)
$Events = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1101; StartTime=$StartTime}
$GroupedEvents = $Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name
$GroupedEvents | Select-Object Name, Count | Format-Table -AutoSize

2. Set up a scheduled task to run this analysis weekly
3. Compare patterns with security logs to correlate authentication events
4. Use Event Viewer custom views to create a dedicated 1101 monitoring view:
5. Right-click Custom Views → Create Custom View
6. Select By log → Application
7. Enter 1101 in Event IDs field
8. Name the view "CEIP Logon Notifications" and save

Adjust Windows telemetry settings to control Event ID 1101 generation:

1. Open Group Policy Editor (gpedit.msc) for local policy changes
2. Navigate to Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds
3. Double-click Allow Telemetry policy
4. Configure telemetry level (0=Security, 1=Basic, 2=Enhanced, 3=Full)
5. Apply changes and run gpupdate /force

For registry-based configuration:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Value 1 -Type DWord

Verify current telemetry settings:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -ErrorAction SilentlyContinue

6. Restart the system or restart the Diagnostic Policy Service:

Restart-Service -Name "DPS" -Force

Investigate the services and processes responsible for generating Event ID 1101:

1. Check the Diagnostic Policy Service status:

Get-Service -Name "DPS" | Format-List Name, Status, StartType, ServiceType

2. Examine Connected User Experiences and Telemetry service:

Get-Service -Name "DiagTrack" | Format-List *

3. Review service dependencies and related processes:

Get-WmiObject -Class Win32_Service -Filter "Name='DiagTrack'" | Select-Object Name, State, StartMode, ProcessId

4. Monitor real-time telemetry activity using Process Monitor:
5. Download and run ProcMon from Microsoft Sysinternals
6. Set filters for Process Name contains "svchost" and Path contains "telemetry"
7. Observe file and registry access patterns during user logon
8. Check Windows Event Forwarding configuration if in enterprise environment:

wecutil es | ForEach-Object { wecutil gs $_ }

Implement comprehensive monitoring for Event ID 1101 in enterprise environments:

1. Create a PowerShell monitoring script for automated analysis:

$LogName = "Application"
$EventID = 1101
$Hours = 24
$StartTime = (Get-Date).AddHours(-$Hours)

$Events = Get-WinEvent -FilterHashtable @{
    LogName = $LogName
    Id = $EventID
    StartTime = $StartTime
} -ErrorAction SilentlyContinue

if ($Events) {
    $EventCount = $Events.Count
    $UniqueUsers = ($Events | ForEach-Object { $_.UserId } | Sort-Object -Unique).Count
    
    Write-Output "Event ID 1101 Summary (Last $Hours hours):"
    Write-Output "Total Events: $EventCount"
    Write-Output "Unique Users: $UniqueUsers"
    Write-Output "Average Events per Hour: $([math]::Round($EventCount/$Hours, 2))"
}

2. Set up Windows Event Forwarding for centralized collection:
3. Configure source computers with: winrm quickconfig
4. On collector server, run: wecutil cs subscription.xml
5. Create subscription XML file targeting Event ID 1101
6. Implement SIEM integration using Windows Event Log API
7. Configure alerting thresholds for unusual logon patterns
8. Create dashboard visualizations for telemetry event trends