Microsoft-Windows-BitLocker-Driver

141 events across 1 channel

Event ID	Title	Channel
24577	Encryption of volume %2 started.	System
24578	Encryption of volume %2 stopped.	System
24579	Encryption of volume %2 completed.	System
24580	Decryption of volume %2 started.	System
24581	Decryption of volume %2 stopped.	System
24582	Decryption of volume %2 completed.	System
24583	Conversion worker thread for volume %2 was started.	System
24584	Conversion worker thread for volume %2 was temporarily stopped.	System
24585	Auto-unlock enabled for volume %2.	System
24586	An error was encountered converting volume %2.	System
24587	Auto-unlock disabled for volume %2.	System
24588	The conversion operation on volume %2 encountered a bad sector error.	System
24589	Failed to enable auto-unlock for volume %2.	System
24590	Failed to disable auto-unlock for volume %2.	System
24591	Auto-unlocking failed for volume %2.	System
24592	An attempt to automatically restart conversion on volume %2 failed.	System
24593	Metadata write: Volume %2 returning errors while trying to modify metadata.	System
24594	Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and …	System
24595	Volume %2 contains bad clusters.	System
24596	No key file was found for Volume %2 during restart.	System
24597	A corrupt key file was encountered for Volume %2 during restart.	System
24598	No volume master key was retrieved in a key file during restart.	System
24599	The TPM was not enabled during restart.	System
24600	The SRK was found to be invalid during restart.	System
24601	The PCRs did not match during restart.	System
24602	No volume master key was retrieved from a key file during restart.	System
24603	A boot application hash did not match expected value during restart.	System
24604	The boot configuration options did not match expected values during restart.	System
24605	No volume master key was retrieved from a PIN during restart.	System
24606	No volume master key was retrieved from a recovery password during restart.	System
24607	A valid key was found during the last restart.	System
24608	An unexpected error was encountered attempting to retrieve the volume master key …	System
24609	A key was not available from required sources during restart.	System
24610	Metadata commit: Not all copies of metadata on volume %2 could be written.	System
24611	Metadata commit: No copies of metadata on volume %2 could be written.	System
24612	Metadata commit: Metadata update could not be flushed.	System
24613	Metadata commit: An attempt to verify metadata update on volume %2 failed at …	System
24614	Metadata commit: Update verification of metadata on volume %2 failed.	System
24615	Metadata initial read: Primary metadata record on volume %2 could not be found.	System
24616	Metadata initial read: Failover metadata record on volume %2 could not be found.	System
24617	Metadata initial read: Failover metadata record on volume %2 used.	System
24618	Metadata check: Metadata record on volume %2 could not be read and has been …	System
24619	Metadata rebuild: An attempt build a new set of metadata on %2 failed at commit …	System
24620	Encrypted volume check: Volume information on %2 cannot be read.	System
24621	Initial state check: Rolling volume conversion transaction on %2.	System
24622	BIOS/TCG Memory Overwrite Control: Error finding TPM driver.	System
24623	BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.	System
24624	BIOS/TCG Memory Overwrite Control: Error changing value.	System
24625	A valid BitLocker key was found during the last restart.	System
24626	The auto-unlock master key was not available from the operating system volume.	System
24627	Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.	System
24628	The partition size specified in the partition table is smaller than the size of …	System
24629	The system firmware failed to enable overwriting of system memory on restart.	System
24630	Bootmgr failed to find a BitLocker key file for Volume %2.	System
24631	Bootmgr detected corruption in the BitLocker key file for Volume %2.	System
24632	Bootmgr failed to obtain the BitLocker volume master key from the key file …	System
24633	Bootmgr determined that the TPM is disabled.	System
24634	Bootmgr determined that the authorization data for the SRK of the TPM is …	System
24635	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System
24636	Bootmgr failed to obtain the BitLocker volume master key from the TPM.	System
24637	A boot application hash did not match the expected value during restart.	System
24638	Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.	System
24639	Bootmgr failed to obtain the BitLocker volume master key from the recovery …	System
24640	A valid BitLocker key was found during the last restart.	System
24641	An unexpected error was encountered attempting to retrieve the BitLocker volume …	System
24642	An internal BitLocker self-test failed for drive %2.	System
24643	Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced …	System
24644	An internal BitLocker self-test failed for drive %2 when switching from raw mode …	System
24645	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24646	Encryption of the used space on volume %2 started.	System
24647	Encryption of the used space on volume %2 stopped.	System
24648	Encryption of the used space on volume %2 completed.	System
24649	Wiping of free space on volume %2 started.	System
24650	Wiping of free space on volume %2 stopped.	System
24651	Wiping of free space on volume %2 completed.	System
24652	A recovery password was used to start Windows.	System
24653	Bootmgr failed to obtain the BitLocker volume master key from the password.	System
24654	A recovery key was used to start Windows.	System
24655	The BitLocker driver has started a self-healing operation on the metadata of …	System
24656	The BitLocker driver has successfully completed a self-healing operation on the …	System
24657	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System
24658	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System
24659	Device Lock was triggered due to too many incorrect password attempts.	System
24660	BitLocker encryption on write started for volume %2.	System
24661	BitLocker free space sweep started for volume %2.	System
24662	BitLocker free space sweep stopped for volume %2.	System
24663	BitLocker free space sweep completed for volume %2.	System
24664	BitLocker finalization sweep started for volume %2.	System
24665	BitLocker finalization sweep paused for volume %2.	System
24666	BitLocker finalization sweep resumed for volume %2.	System
24667	BitLocker finalization sweep completed for volume %2.	System
24668	BitLocker encryption on write failed for volume %2 due to disk I/O error.	System
24669	BitLocker finalization sweep failed for volume %2 due to disk I/O error.	System
24670	Disk containing volume %2 is employing non-volatile caching software which does …	System
24671	Disk containing volume %2 is employing non-volatile caching software which is …	System
24672	Device Lock was triggered due to Device Lockout state validation failure.	System
24673	Drive %2 is no longer automatically managed by device encryption.	System
24674	Drive %2 is now automatically managed by device encryption.	System
24675	WIM hash generation paused for volume %2.	System
24676	WIM hash generation resumed for volume %2.	System
24677	WIM hash generation completed for volume %2.	System
24678	WIM hash generation failed for volume %2.	System
24679	WIM hashes will be deleted for volume %2.	System
24680	Bootmgr failed to unseal VMK using the TPM	System
24681	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24682	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24683	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24684	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24685	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System
24686	Bootmgr failed to obtain the BitLocker volume master key from the network boot …	System
24687	BitLocker timed out attempting to enumerate bands during volume discovery on …	System
24688	Failed to read metadata from logical copy.	System
24689	Attempted to read metadata from logical copy.	System
24690	Attempted to fix metadata logical copies.	System
24691	Failed to verify metadata logical copy against Primary.	System
24692	Failed to verify metadata file against Primary copy.	System
24693	Failed to register metadata check worker.	System
24694	Metadata check worker started.	System
24695	Metadata check worker completed.	System
24696	Successfully created metadata file.	System
24697	Failed to read a valid metadata copy.	System
24698	Failed to fix metadata logical copy.	System
24699	Attempted to check metadata logical copies.	System
24700	Successfully fixed metadata logical copy.	System
24701	Volume %2 has been excluded from device encryption by BitLocker Drive Encryption …	System
24702	Read-only BitLocker Drive Encryption policy has been applied to volume %2.	System
24703	Failed to determine whether volume %2 should be excluded from enforcement by …	System
24704	BitLocker Drive Encryption metadata was found to use unencrypted integrity …	System
24705	TPM protector %2 binding %3 final PCR values did not match those observed in the …	System
24706	TPM protector %2 binding %3 final PCR values did not match those observed in the …	System
24707	TPM protector %2 binding %3 final PCR values did not match those observed in the …	System
24708	TPM protector %2 binding %3 final PCR values did not match those observed in the …	System
24709	This event contains the boot-time final TPM PCR values and TCG log data.	System
24710	There was a problem communicating with the TPM at boot.	System
24711	A V2 TPM protector was used to start Windows.	System
24712	The TPM was not available at boot.	System
24713	The Inline Crypto Engine hardware did not produce the expected cryptographic …	System
24720	A TPM protector binding failed to unlock the volume despite matching the …	System
24721	A V2 TPM protector could not be used to start Windows.	System
24722	A hardware protected key was not provisioned for the volume.	System
24723	A hardware protected key was not used for the volume.	System

Event ID 24577 — Encryption of volume %2 started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of volume %2 started.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24578 — Encryption of volume %2 stopped.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of volume %2 stopped.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24579 — Encryption of volume %2 completed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of volume %2 completed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24580 — Decryption of volume %2 started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Decryption of volume %2 started.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24581 — Decryption of volume %2 stopped.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Decryption of volume %2 stopped.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24582 — Decryption of volume %2 completed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Decryption of volume %2 completed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24583 — Conversion worker thread for volume %2 was started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Conversion worker thread for volume %2 was started.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24584 — Conversion worker thread for volume %2 was temporarily stopped.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Conversion worker thread for volume %2 was temporarily stopped.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24585 — Auto-unlock enabled for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Auto-unlock enabled for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24586 — An error was encountered converting volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An error was encountered converting volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24587 — Auto-unlock disabled for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Auto-unlock disabled for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24588 — The conversion operation on volume %2 encountered a bad sector error.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The conversion operation on volume %2 encountered a bad sector error. Please validate the data on this volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24589 — Failed to enable auto-unlock for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to enable auto-unlock for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24590 — Failed to disable auto-unlock for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to disable auto-unlock for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24591 — Auto-unlocking failed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Auto-unlocking failed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24592 — An attempt to automatically restart conversion on volume %2 failed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An attempt to automatically restart conversion on volume %2 failed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24593 — Metadata write: Volume %2 returning errors while trying to modify metadata.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata write: Volume %2 returning errors while trying to modify metadata. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24594 — Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and may appear as disk corruption.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and may appear as disk corruption. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24595 — Volume %2 contains bad clusters.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Volume %2 contains bad clusters. These clusters will be skipped during conversion.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24596 — No key file was found for Volume %2 during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

No key file was found for Volume %2 during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24597 — A corrupt key file was encountered for Volume %2 during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A corrupt key file was encountered for Volume %2 during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24598 — No volume master key was retrieved in a key file during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

No volume master key was retrieved in a key file during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24599 — The TPM was not enabled during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The TPM was not enabled during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24600 — The SRK was found to be invalid during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The SRK was found to be invalid during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24601 — The PCRs did not match during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The PCRs did not match during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24602 — No volume master key was retrieved from a key file during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

No volume master key was retrieved from a key file during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24603 — A boot application hash did not match expected value during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A boot application hash did not match expected value during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24604 — The boot configuration options did not match expected values during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The boot configuration options did not match expected values during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24605 — No volume master key was retrieved from a PIN during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

No volume master key was retrieved from a PIN during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24606 — No volume master key was retrieved from a recovery password during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

No volume master key was retrieved from a recovery password during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24607 — A valid key was found during the last restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A valid key was found during the last restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24608 — An unexpected error was encountered attempting to retrieve the volume master key during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An unexpected error was encountered attempting to retrieve the volume master key during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24609 — A key was not available from required sources during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A key was not available from required sources during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24610 — Metadata commit: Not all copies of metadata on volume %2 could be written.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata commit: Not all copies of metadata on volume %2 could be written. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24611 — Metadata commit: No copies of metadata on volume %2 could be written.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata commit: No copies of metadata on volume %2 could be written. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24612 — Metadata commit: Metadata update could not be flushed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata commit: Metadata update could not be flushed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24613 — Metadata commit: An attempt to verify metadata update on volume %2 failed at read.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata commit: An attempt to verify metadata update on volume %2 failed at read. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24614 — Metadata commit: Update verification of metadata on volume %2 failed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata commit: Update verification of metadata on volume %2 failed. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24615 — Metadata initial read: Primary metadata record on volume %2 could not be found.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata initial read: Primary metadata record on volume %2 could not be found. Volume needs recovery.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24616 — Metadata initial read: Failover metadata record on volume %2 could not be found.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata initial read: Failover metadata record on volume %2 could not be found. Volume needs recovery.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24617 — Metadata initial read: Failover metadata record on volume %2 used.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata initial read: Failover metadata record on volume %2 used. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24618 — Metadata check: Metadata record on volume %2 could not be read and has been marked for rebuild.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata check: Metadata record on volume %2 could not be read and has been marked for rebuild. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24619 — Metadata rebuild: An attempt build a new set of metadata on %2 failed at commit and may appear as disk corruption.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata rebuild: An attempt build a new set of metadata on %2 failed at commit and may appear as disk corruption. If failures continue, decrypt volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24620 — Encrypted volume check: Volume information on %2 cannot be read.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encrypted volume check: Volume information on %2 cannot be read.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24621 — Initial state check: Rolling volume conversion transaction on %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Initial state check: Rolling volume conversion transaction on %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24622 — BIOS/TCG Memory Overwrite Control: Error finding TPM driver.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BIOS/TCG Memory Overwrite Control: Error finding TPM driver.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24623 — BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24624 — BIOS/TCG Memory Overwrite Control: Error changing value.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BIOS/TCG Memory Overwrite Control: Error changing value.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24625 — A valid BitLocker key was found during the last restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A valid BitLocker key was found during the last restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24626 — The auto-unlock master key was not available from the operating system volume.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The auto-unlock master key was not available from the operating system volume.  Retry the operation via the BitLocker WMI interface.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24627 — Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24628 — The partition size specified in the partition table is smaller than the size of the file system contained by that partition.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The partition size specified in the partition table is smaller than the size of the file system contained by that partition.  BitLocker TPM based keys cannot be used until the size of the partition calculated from the partition table is consistent with the size of the file system calculated from the bytes per sector and number of sectors fields in the boot sector.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24629 — The system firmware failed to enable overwriting of system memory on restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The system firmware failed to enable overwriting of system memory on restart. The firmware should be upgraded.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24630 — Bootmgr failed to find a BitLocker key file for Volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to find a BitLocker key file for Volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24631 — Bootmgr detected corruption in the BitLocker key file for Volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr detected corruption in the BitLocker key file for Volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24632 — Bootmgr failed to obtain the BitLocker volume master key from the key file contents.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the key file contents.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24633 — Bootmgr determined that the TPM is disabled.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr determined that the TPM is disabled.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24634 — Bootmgr determined that the authorization data for the SRK of the TPM is incompatible with BitLocker.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr determined that the authorization data for the SRK of the TPM is incompatible with BitLocker.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24635 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because the PCRs did not match.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM because the PCRs did not match.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24636 — Bootmgr failed to obtain the BitLocker volume master key from the TPM.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24637 — A boot application hash did not match the expected value during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A boot application hash did not match the expected value during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24638 — Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24639 — Bootmgr failed to obtain the BitLocker volume master key from the recovery password.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the recovery password.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24640 — A valid BitLocker key was found during the last restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A valid BitLocker key was found during the last restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24641 — An unexpected error was encountered attempting to retrieve the BitLocker volume master key during restart.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An unexpected error was encountered attempting to retrieve the BitLocker volume master key during restart.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24642 — An internal BitLocker self-test failed for drive %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An internal BitLocker self-test failed for drive %2. BitLocker cannot continue encrypting data. Contact your system administrator.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24643 — Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced PIN.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced PIN.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24644 — An internal BitLocker self-test failed for drive %2 when switching from raw mode to filtering mode.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

An internal BitLocker self-test failed for drive %2 when switching from raw mode to filtering mode. BitLocker cannot continue encrypting data on this drive. Contact your system administrator.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24645 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24646 — Encryption of the used space on volume %2 started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of the used space on volume %2 started.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24647 — Encryption of the used space on volume %2 stopped.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of the used space on volume %2 stopped.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24648 — Encryption of the used space on volume %2 completed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Encryption of the used space on volume %2 completed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24649 — Wiping of free space on volume %2 started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Wiping of free space on volume %2 started.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24650 — Wiping of free space on volume %2 stopped.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Wiping of free space on volume %2 stopped.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24651 — Wiping of free space on volume %2 completed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Wiping of free space on volume %2 completed.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24652 — A recovery password was used to start Windows.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A recovery password was used to start Windows.
Protector ID: %5.

Fields

Name	Description
`Protector_ID`	—
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24653 — Bootmgr failed to obtain the BitLocker volume master key from the password.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the password.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24654 — A recovery key was used to start Windows.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A recovery key was used to start Windows.
Protector ID: %5.

Fields

Name	Description
`Protector_ID`	—
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24655 — The BitLocker driver has started a self-healing operation on the metadata of volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The BitLocker driver has started a self-healing operation on the metadata of volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24656 — The BitLocker driver has successfully completed a self-healing operation on the metadata of volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The BitLocker driver has successfully completed a self-healing operation on the metadata of volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24657 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot was disabled.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot was disabled.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24658 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot configuration changed unexpectedly.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot configuration changed unexpectedly.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24659 — Device Lock was triggered due to too many incorrect password attempts.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Device Lock was triggered due to too many incorrect password attempts.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24660 — BitLocker encryption on write started for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker encryption on write started for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24661 — BitLocker free space sweep started for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker free space sweep started for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24662 — BitLocker free space sweep stopped for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker free space sweep stopped for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24663 — BitLocker free space sweep completed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker free space sweep completed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24664 — BitLocker finalization sweep started for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker finalization sweep started for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24665 — BitLocker finalization sweep paused for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker finalization sweep paused for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24666 — BitLocker finalization sweep resumed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker finalization sweep resumed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24667 — BitLocker finalization sweep completed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker finalization sweep completed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24668 — BitLocker encryption on write failed for volume %2 due to disk I/O error.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker encryption on write failed for volume %2 due to disk I/O error. Check the disk for bad sectors.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24669 — BitLocker finalization sweep failed for volume %2 due to disk I/O error.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker finalization sweep failed for volume %2 due to disk I/O error. Check the disk for bad sectors.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24670 — Disk containing volume %2 is employing non-volatile caching software which does not support control over its caching policies.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Disk containing volume %2 is employing non-volatile caching software which does not support control over its caching policies. This may temporarily impact BitLocker's ability to fully secure your data.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24671 — Disk containing volume %2 is employing non-volatile caching software which is experiencing problems.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Disk containing volume %2 is employing non-volatile caching software which is experiencing problems. This may temporarily impact BitLocker's ability to fully secure your data. Contact disk manufacturer for an updated software.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24672 — Device Lock was triggered due to Device Lockout state validation failure.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Device Lock was triggered due to Device Lockout state validation failure.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24673 — Drive %2 is no longer automatically managed by device encryption.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Drive %2 is no longer automatically managed by device encryption.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24674 — Drive %2 is now automatically managed by device encryption.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Drive %2 is now automatically managed by device encryption.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24675 — WIM hash generation paused for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

WIM hash generation paused for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24676 — WIM hash generation resumed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

WIM hash generation resumed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24677 — WIM hash generation completed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

WIM hash generation completed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24678 — WIM hash generation failed for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

WIM hash generation failed for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24679 — WIM hashes will be deleted for volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

WIM hashes will be deleted for volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24680 — Bootmgr failed to unseal VMK using the TPM

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to unseal VMK using the TPM

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24681 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to acquire protocol handle.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to acquire protocol handle.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24682 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to get IP address.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to get IP address.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24683 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to create request.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to create request.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24684 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to send request.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to send request.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24685 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: invalid response.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network key protector: invalid response.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24686 — Bootmgr failed to obtain the BitLocker volume master key from the network boot protector.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Bootmgr failed to obtain the BitLocker volume master key from the network boot protector.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24687 — BitLocker timed out attempting to enumerate bands during volume discovery on this hardware encrypting drive.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker timed out attempting to enumerate bands during volume discovery on this hardware encrypting drive.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24688 — Failed to read metadata from logical copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to read metadata from logical copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24689 — Attempted to read metadata from logical copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Attempted to read metadata from logical copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24690 — Attempted to fix metadata logical copies.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Attempted to fix metadata logical copies. Volume: %2, ManageFlags: %3

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24691 — Failed to verify metadata logical copy against Primary.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to verify metadata logical copy against Primary. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24692 — Failed to verify metadata file against Primary copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to verify metadata file against Primary copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24693 — Failed to register metadata check worker.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to register metadata check worker. Volume: %2

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24694 — Metadata check worker started.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata check worker started. Volume: %2

Fields

Name	Description
`Metadata_check_worker_started_Volume`	—
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24695 — Metadata check worker completed.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Metadata check worker completed. Volume: %2

Fields

Name	Description
`Metadata_check_worker_completed_Volume`	—
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24696 — Successfully created metadata file.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Successfully created metadata file. Volume: %2, Offset: %3, Read Length: %4, Copy: %5, Number of Copies: %6, TpAllocationSize: %7

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	Successfully created metadata file. Volume.
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24697 — Failed to read a valid metadata copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to read a valid metadata copy. Volume: %2, Start Offset: %3, Index: %5

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24698 — Failed to fix metadata logical copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to fix metadata logical copy. Volume: %2, Start Offset: %3,  Read Length: %4, Source Index: %5, Number of Copies: %6, TpAllocationSize: %7

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24699 — Attempted to check metadata logical copies.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Attempted to check metadata logical copies. Volume: %2, ManageFlags: %3

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24700 — Successfully fixed metadata logical copy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Successfully fixed metadata logical copy. Volume: %2, Start Offset: %3,  Read Length: %4, Source Index: %5, Number of Copies: %6, TpAllocationSize: %7

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`Offset`	—
`Length`	—
`Copy`	—
`TotalCopies`	—
`SlabSize`	—

Event ID 24701 — Volume %2 has been excluded from device encryption by BitLocker Drive Encryption policy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Volume %2 has been excluded from device encryption by BitLocker Drive Encryption policy. Excluded Hardware ID: '%3'

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`HardwareID`	—

Event ID 24702 — Read-only BitLocker Drive Encryption policy has been applied to volume %2.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Read-only BitLocker Drive Encryption policy has been applied to volume %2.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24703 — Failed to determine whether volume %2 should be excluded from enforcement by BitLocker Drive Encryption policy.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

Failed to determine whether volume %2 should be excluded from enforcement by BitLocker Drive Encryption policy.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24704 — BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume %1.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume %1.

Fields

Name	Description
`Volume`	—
`VolumeGUID`	—
`State`	—
`Direction`	—
`StateOffset`	—
`StateSize`	—

Event ID 24705 — TPM protector %2 binding %3 final PCR values did not match those observed in the TPM.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields

Name	Description
`ContextFlags`	—
`ProtectorGUID`	—
`BindingGUID`	—
`BindingCreationScenario`	—
`DateTimeOfSeal`	—
`DateTimeOfMismatch`	—
`PcrBitmap`	—
`TcgLogIsValidStatus`	—
`BindingDatumIsValidStatus`	—
`MismatchedPcrInfoFlags`	—
`MismatchedPcr`	—
`ExpectedHashAlgorithm`	—
`ExpectedHashAlgorithmSize`	—
`ObservedHashAlgorithm`	—
`ObservedHashAlgorithmSize`	—
`ExpectedEventsCount`	—
`ObservedEventsCount`	—
`MismatchedEvent`	—
`ExpectedEventType`	—
`ObservedEventType`	—
`ExpectedDigest`	—
`ObservedDigest`	—
`ExpectedEventLabel`	—
`ObservedEventLabel`	—
`SealedPcrValuesSize`	—
`SealedPcrValues`	—

Event ID 24706 — TPM protector %2 binding %3 final PCR values did not match those observed in the TPM.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields

Name	Description
`ContextFlags`	—
`ProtectorGUID`	—
`BindingGUID`	—
`BindingCreationScenario`	—
`DateTimeOfSeal`	—
`DateTimeOfMismatch`	—
`PcrBitmap`	—
`TcgLogIsValidStatus`	—
`BindingDatumIsValidStatus`	—
`MismatchedPcrInfoFlags`	—
`MismatchedPcr`	—
`ExpectedHashAlgorithm`	—
`ExpectedHashAlgorithmSize`	—
`ObservedHashAlgorithm`	—
`ObservedHashAlgorithmSize`	—
`ExpectedEventsCount`	—
`ObservedEventsCount`	—
`MismatchedEvent`	—
`ExpectedEventType`	—
`ObservedEventType`	—
`ExpectedDigest`	—
`ObservedDigest`	—
`ExpectedEventLabel`	—
`SealedPcrValuesSize`	—
`SealedPcrValues`	—

Event ID 24707 — TPM protector %2 binding %3 final PCR values did not match those observed in the TPM.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields

Name	Description
`ContextFlags`	—
`ProtectorGUID`	—
`BindingGUID`	—
`BindingCreationScenario`	—
`DateTimeOfSeal`	—
`DateTimeOfMismatch`	—
`PcrBitmap`	—
`TcgLogIsValidStatus`	—
`BindingDatumIsValidStatus`	—
`MismatchedPcrInfoFlags`	—
`MismatchedPcr`	—
`ExpectedHashAlgorithm`	—
`ExpectedHashAlgorithmSize`	—
`ObservedHashAlgorithm`	—
`ObservedHashAlgorithmSize`	—
`ExpectedEventsCount`	—
`ObservedEventsCount`	—
`MismatchedEvent`	—
`ExpectedEventType`	—
`ObservedEventType`	—
`ExpectedDigest`	—
`ObservedDigest`	—
`ObservedEventLabel`	—
`SealedPcrValuesSize`	—
`SealedPcrValues`	—

Event ID 24708 — TPM protector %2 binding %3 final PCR values did not match those observed in the TPM.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields

Name	Description
`ContextFlags`	—
`ProtectorGUID`	—
`BindingGUID`	—
`BindingCreationScenario`	—
`DateTimeOfSeal`	—
`DateTimeOfMismatch`	—
`PcrBitmap`	—
`TcgLogIsValidStatus`	—
`BindingDatumIsValidStatus`	—
`MismatchedPcrInfoFlags`	—
`MismatchedPcr`	—
`ExpectedHashAlgorithm`	—
`ExpectedHashAlgorithmSize`	—
`ObservedHashAlgorithm`	—
`ObservedHashAlgorithmSize`	—
`ExpectedEventsCount`	—
`ObservedEventsCount`	—
`MismatchedEvent`	—
`ExpectedEventType`	—
`ObservedEventType`	—
`ExpectedDigest`	—
`ObservedDigest`	—
`SealedPcrValuesSize`	—
`SealedPcrValues`	—

Event ID 24709 — This event contains the boot-time final TPM PCR values and TCG log data.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

This event contains the boot-time final TPM PCR values and TCG log data.

Fields

Name	Description
`DateTime`	—
`IsSecureBootOn`	—
`TcgLogHashAlgorithm`	—
`TcgLogHashAlgorithmSize`	—
`AllFinalPcrValuesPcrBitmap`	—
`CountPcrsInAllFinalPcrValuesPcrBitmap`	—
`AllPcrDatasPcrBitmap`	—
`CountPcrsInAllPcrDatasPcrBitmap`	—
`FinalPcrValuesSize`	—
`FinalPcrValues`	—
`SealedPcrDigestsDatumsSize`	—
`SealedPcrDigestsDatums`	—

Event ID 24710 — There was a problem communicating with the TPM at boot.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

There was a problem communicating with the TPM at boot.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24711 — A V2 TPM protector was used to start Windows.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A V2 TPM protector was used to start Windows.
Binding ID: %5.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24712 — The TPM was not available at boot.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The TPM was not available at boot.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24713 — The Inline Crypto Engine hardware did not produce the expected cryptographic output.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

The Inline Crypto Engine hardware did not produce the expected cryptographic output. Volume: %2

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24720 — A TPM protector binding failed to unlock the volume despite matching the expected TPM unlock state.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A TPM protector binding failed to unlock the volume despite matching the expected TPM unlock state.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24721 — A V2 TPM protector could not be used to start Windows.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A V2 TPM protector could not be used to start Windows.
Binding ID: %5.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—
`VolumeGUID`	—
`OptionalGUID`	—
`Flags`	—

Event ID 24722 — A hardware protected key was not provisioned for the volume.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A hardware protected key was not provisioned for the volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—

Event ID 24723 — A hardware protected key was not used for the volume.

Provider: Microsoft-Windows-BitLocker-Driver
Channel: System

Message

A hardware protected key was not used for the volume.

Fields

Name	Description
`ErrorCode`	—
`Volume`	—
`WritePhase`	—