Microsoft-Windows-BitLocker-Driver
141 events across 1 channel
Event ID 24577 — Encryption of volume Volume started.
Event ID 24578 — Encryption of volume Volume stopped.
Event ID 24579 — Encryption of volume Volume completed.
Event ID 24580 — Decryption of volume Volume started.
Event ID 24581 — Decryption of volume Volume stopped.
Event ID 24582 — Decryption of volume Volume completed.
Event ID 24583 — Conversion worker thread for volume Volume was started.
Event ID 24584 — Conversion worker thread for volume Volume was temporarily stopped.
Event ID 24585 — Auto-unlock enabled for volume Volume.
Event ID 24586 — An error was encountered converting volume Volume.
Event ID 24587 — Auto-unlock disabled for volume Volume.
Event ID 24588 — The conversion operation on volume Volume encountered a bad sector error.
Event ID 24589 — Failed to enable auto-unlock for volume Volume.
Event ID 24590 — Failed to disable auto-unlock for volume Volume.
Event ID 24591 — Auto-unlocking failed for volume Volume.
Event ID 24592 — An attempt to automatically restart conversion on volume Volume failed.
Event ID 24593 — Metadata write: Volume Volume returning errors while trying to modify metadata.
Event ID 24594 — Metadata rebuild: An attempt to write a copy of metadata on volume Volume failed and may appear as disk corruption.
Event ID 24595 — Volume Volume contains bad clusters.
Event ID 24596 — No key file was found for Volume Volume during restart.
Event ID 24597 — A corrupt key file was encountered for Volume Volume during restart.
Event ID 24598 — No volume master key was retrieved in a key file during restart.
Event ID 24599 — The TPM was not enabled during restart.
Event ID 24600 — The SRK was found to be invalid during restart.
Event ID 24601 — The PCRs did not match during restart.
Event ID 24602 — No volume master key was retrieved from a key file during restart.
Event ID 24603 — A boot application hash did not match expected value during restart.
Event ID 24604 — The boot configuration options did not match expected values during restart.
Event ID 24605 — No volume master key was retrieved from a PIN during restart.
Event ID 24606 — No volume master key was retrieved from a recovery password during restart.
Event ID 24607 — A valid key was found during the last restart.
Event ID 24608 — An unexpected error was encountered attempting to retrieve the volume master key during restart.
Event ID 24609 — A key was not available from required sources during restart.
Event ID 24610 — Metadata commit: Not all copies of metadata on volume Volume could be written.
Event ID 24611 — Metadata commit: No copies of metadata on volume Volume could be written.
Event ID 24612 — Metadata commit: Metadata update could not be flushed.
Event ID 24613 — Metadata commit: An attempt to verify metadata update on volume Volume failed at read.
Event ID 24614 — Metadata commit: Update verification of metadata on volume Volume failed.
Event ID 24615 — Metadata initial read: Primary metadata record on volume Volume could not be found.
Event ID 24616 — Metadata initial read: Failover metadata record on volume Volume could not be found.
Event ID 24617 — Metadata initial read: Failover metadata record on volume Volume used.
Event ID 24618 — Metadata check: Metadata record on volume Volume could not be read and has been marked for rebuild.
Event ID 24619 — Metadata rebuild: An attempt build a new set of metadata on Volume failed at commit and may appear as disk corruption.
Event ID 24620 — Encrypted volume check: Volume information on Volume cannot be read.
Event ID 24621 — Initial state check: Rolling volume conversion transaction on Volume.
Event ID 24622 — BIOS/TCG Memory Overwrite Control: Error finding TPM driver.
Event ID 24623 — BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.
Event ID 24624 — BIOS/TCG Memory Overwrite Control: Error changing value.
Event ID 24625 — A valid BitLocker key was found during the last restart.
Event ID 24626 — The auto-unlock master key was not available from the operating system volume.
Event ID 24627 — Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.
Event ID 24628 — The partition size specified in the partition table is smaller than the size of the file system contained by that partition.
Event ID 24629 — The system firmware failed to enable overwriting of system memory on restart.
Event ID 24630 — Bootmgr failed to find a BitLocker key file for Volume Volume.
Event ID 24631 — Bootmgr detected corruption in the BitLocker key file for Volume Volume.
Event ID 24632 — Bootmgr failed to obtain the BitLocker volume master key from the key file contents.
Event ID 24633 — Bootmgr determined that the TPM is disabled.
Event ID 24634 — Bootmgr determined that the authorization data for the SRK of the TPM is incompatible with BitLocker.
Event ID 24635 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because the PCRs did not match.
Event ID 24636 — Bootmgr failed to obtain the BitLocker volume master key from the TPM.
Event ID 24637 — A boot application hash did not match the expected value during restart.
Event ID 24638 — Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.
Event ID 24639 — Bootmgr failed to obtain the BitLocker volume master key from the recovery password.
Event ID 24640 — A valid BitLocker key was found during the last restart.
Event ID 24641 — An unexpected error was encountered attempting to retrieve the BitLocker volume master key during restart.
Event ID 24642 — An internal BitLocker self-test failed for drive Volume.
Event ID 24643 — Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced PIN.
Event ID 24644 — An internal BitLocker self-test failed for drive Volume when switching from raw mode to filtering mode.
Event ID 24645 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector.
Event ID 24646 — Encryption of the used space on volume Volume started.
Event ID 24647 — Encryption of the used space on volume Volume stopped.
Event ID 24648 — Encryption of the used space on volume Volume completed.
Event ID 24649 — Wiping of free space on volume Volume started.
Event ID 24650 — Wiping of free space on volume Volume stopped.
Event ID 24651 — Wiping of free space on volume Volume completed.
Event ID 24652 — A recovery password was used to start Windows.
Event ID 24653 — Bootmgr failed to obtain the BitLocker volume master key from the password.
Event ID 24654 — A recovery key was used to start Windows.
Event ID 24655 — The BitLocker driver has started a self-healing operation on the metadata of volume Volume.
Event ID 24656 — The BitLocker driver has successfully completed a self-healing operation on the metadata of volume Volume.
Event ID 24657 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot was disabled.
Event ID 24658 — Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot configuration changed unexpectedly.
Event ID 24659 — Device Lock was triggered due to too many incorrect password attempts.
Event ID 24660 — BitLocker encryption on write started for volume Volume.
Event ID 24661 — BitLocker free space sweep started for volume Volume.
Event ID 24662 — BitLocker free space sweep stopped for volume Volume.
Event ID 24663 — BitLocker free space sweep completed for volume Volume.
Event ID 24664 — BitLocker finalization sweep started for volume Volume.
Event ID 24665 — BitLocker finalization sweep paused for volume Volume.
Event ID 24666 — BitLocker finalization sweep resumed for volume Volume.
Event ID 24667 — BitLocker finalization sweep completed for volume Volume.
Event ID 24668 — BitLocker encryption on write failed for volume Volume due to disk I/O error.
Event ID 24669 — BitLocker finalization sweep failed for volume Volume due to disk I/O error.
Event ID 24670 — Disk containing volume Volume is employing non-volatile caching software which does not support control over its caching policies.
Description
Disk containing volume is employing non-volatile caching software which does not support control over its caching policies. This may temporarily impact BitLocker's ability to fully secure your data.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
WritePhase HexInt32 | — |
Event ID 24671 — Disk containing volume Volume is employing non-volatile caching software which is experiencing problems.
Event ID 24672 — Device Lock was triggered due to Device Lockout state validation failure.
Event ID 24673 — Drive Volume is no longer automatically managed by device encryption.
Event ID 24674 — Drive Volume is now automatically managed by device encryption.
Event ID 24675 — WIM hash generation paused for volume Volume.
Event ID 24676 — WIM hash generation resumed for volume Volume.
Event ID 24677 — WIM hash generation completed for volume Volume.
Event ID 24678 — WIM hash generation failed for volume Volume.
Event ID 24679 — WIM hashes will be deleted for volume Volume.
Event ID 24680 — Bootmgr failed to unseal VMK using the TPM
Event ID 24681 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to acquire protocol handle.
Event ID 24682 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to get IP address.
Event ID 24683 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to create request.
Event ID 24684 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to send request.
Event ID 24685 — Bootmgr failed to obtain the BitLocker volume master key from the network key protector: invalid response.
Event ID 24686 — Bootmgr failed to obtain the BitLocker volume master key from the network boot protector.
Event ID 24687 — BitLocker timed out attempting to enumerate bands during volume discovery on this hardware encrypting drive.
Event ID 24688 — Failed to read metadata from logical copy.
Description
Failed to read metadata from logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24689 — Attempted to read metadata from logical copy.
Description
Attempted to read metadata from logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24690 — Attempted to fix metadata logical copies.
Event ID 24691 — Failed to verify metadata logical copy against Primary.
Description
Failed to verify metadata logical copy against Primary. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24692 — Failed to verify metadata file against Primary copy.
Description
Failed to verify metadata file against Primary copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24693 — Failed to register metadata check worker.
Event ID 24694 — Metadata check worker started.
Event ID 24695 — Metadata check worker completed.
Event ID 24696 — Successfully created metadata file.
Description
Successfully created metadata file. Volume: Volume, Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | Successfully created metadata file. Volume. |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24697 — Failed to read a valid metadata copy.
Event ID 24698 — Failed to fix metadata logical copy.
Description
Failed to fix metadata logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Source Index: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24699 — Attempted to check metadata logical copies.
Event ID 24700 — Successfully fixed metadata logical copy.
Description
Successfully fixed metadata logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Source Index: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode HexInt32 | — |
Volume UnicodeString | — |
Offset UInt64 | — |
Length UInt64 | — |
Copy UInt64 | — |
TotalCopies UInt64 | — |
SlabSize UInt64 | — |
Event ID 24701 — Volume Volume has been excluded from device encryption by BitLocker Drive Encryption policy.
Event ID 24702 — Read-only BitLocker Drive Encryption policy has been applied to volume Volume.
Event ID 24703 — Failed to determine whether volume Volume should be excluded from enforcement by BitLocker Drive Encryption policy.
Event ID 24704 — BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume Volume.
Description
BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume Volume.
Message #
Fields #
| Name | Description |
|---|---|
Volume UnicodeString | — |
VolumeGUID GUID | — |
State HexInt32 | — |
Direction HexInt32 | — Known values
|
StateOffset HexInt64 | — |
StateSize HexInt32 | — |
Event ID 24705 — TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Description
TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Message #
Fields #
| Name | Description |
|---|---|
ContextFlags HexInt32 | — |
ProtectorGUID GUID | — |
BindingGUID GUID | — |
BindingCreationScenario UInt32 | — |
DateTimeOfSeal FILETIME | — |
DateTimeOfMismatch FILETIME | — |
PcrBitmap HexInt32 | — |
TcgLogIsValidStatus HexInt32 | — |
BindingDatumIsValidStatus HexInt32 | — |
MismatchedPcrInfoFlags HexInt32 | — |
MismatchedPcr UInt32 | — |
ExpectedHashAlgorithm HexInt32 | — |
ExpectedHashAlgorithmSize UInt16 | — |
ObservedHashAlgorithm HexInt32 | — |
ObservedHashAlgorithmSize UInt16 | — |
ExpectedEventsCount UInt16 | — |
ObservedEventsCount UInt16 | — |
MismatchedEvent UInt16 | — |
ExpectedEventType HexInt32 | — |
ObservedEventType HexInt32 | — |
ExpectedDigest Binary | — |
ObservedDigest Binary | — |
ExpectedEventLabel UnicodeString | — |
ObservedEventLabel UnicodeString | — |
SealedPcrValuesSize UInt16 | — |
SealedPcrValues Binary | — |
Event ID 24706 — TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Description
TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Message #
Fields #
| Name | Description |
|---|---|
ContextFlags HexInt32 | — |
ProtectorGUID GUID | — |
BindingGUID GUID | — |
BindingCreationScenario UInt32 | — |
DateTimeOfSeal FILETIME | — |
DateTimeOfMismatch FILETIME | — |
PcrBitmap HexInt32 | — |
TcgLogIsValidStatus HexInt32 | — |
BindingDatumIsValidStatus HexInt32 | — |
MismatchedPcrInfoFlags HexInt32 | — |
MismatchedPcr UInt32 | — |
ExpectedHashAlgorithm HexInt32 | — |
ExpectedHashAlgorithmSize UInt16 | — |
ObservedHashAlgorithm HexInt32 | — |
ObservedHashAlgorithmSize UInt16 | — |
ExpectedEventsCount UInt16 | — |
ObservedEventsCount UInt16 | — |
MismatchedEvent UInt16 | — |
ExpectedEventType HexInt32 | — |
ObservedEventType HexInt32 | — |
ExpectedDigest Binary | — |
ObservedDigest Binary | — |
ExpectedEventLabel UnicodeString | — |
SealedPcrValuesSize UInt16 | — |
SealedPcrValues Binary | — |
Event ID 24707 — TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Description
TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Message #
Fields #
| Name | Description |
|---|---|
ContextFlags HexInt32 | — |
ProtectorGUID GUID | — |
BindingGUID GUID | — |
BindingCreationScenario UInt32 | — |
DateTimeOfSeal FILETIME | — |
DateTimeOfMismatch FILETIME | — |
PcrBitmap HexInt32 | — |
TcgLogIsValidStatus HexInt32 | — |
BindingDatumIsValidStatus HexInt32 | — |
MismatchedPcrInfoFlags HexInt32 | — |
MismatchedPcr UInt32 | — |
ExpectedHashAlgorithm HexInt32 | — |
ExpectedHashAlgorithmSize UInt16 | — |
ObservedHashAlgorithm HexInt32 | — |
ObservedHashAlgorithmSize UInt16 | — |
ExpectedEventsCount UInt16 | — |
ObservedEventsCount UInt16 | — |
MismatchedEvent UInt16 | — |
ExpectedEventType HexInt32 | — |
ObservedEventType HexInt32 | — |
ExpectedDigest Binary | — |
ObservedDigest Binary | — |
ObservedEventLabel UnicodeString | — |
SealedPcrValuesSize UInt16 | — |
SealedPcrValues Binary | — |
Event ID 24708 — TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Description
TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.
Message #
Fields #
| Name | Description |
|---|---|
ContextFlags HexInt32 | — |
ProtectorGUID GUID | — |
BindingGUID GUID | — |
BindingCreationScenario UInt32 | — |
DateTimeOfSeal FILETIME | — |
DateTimeOfMismatch FILETIME | — |
PcrBitmap HexInt32 | — |
TcgLogIsValidStatus HexInt32 | — |
BindingDatumIsValidStatus HexInt32 | — |
MismatchedPcrInfoFlags HexInt32 | — |
MismatchedPcr UInt32 | — |
ExpectedHashAlgorithm HexInt32 | — |
ExpectedHashAlgorithmSize UInt16 | — |
ObservedHashAlgorithm HexInt32 | — |
ObservedHashAlgorithmSize UInt16 | — |
ExpectedEventsCount UInt16 | — |
ObservedEventsCount UInt16 | — |
MismatchedEvent UInt16 | — |
ExpectedEventType HexInt32 | — |
ObservedEventType HexInt32 | — |
ExpectedDigest Binary | — |
ObservedDigest Binary | — |
SealedPcrValuesSize UInt16 | — |
SealedPcrValues Binary | — |
Event ID 24709 — This event contains the boot-time final TPM PCR values and TCG log data.
Description
This event contains the boot-time final TPM PCR values and TCG log data.
Message #
Fields #
| Name | Description |
|---|---|
DateTime FILETIME | — |
IsSecureBootOn Boolean | — |
TcgLogHashAlgorithm HexInt32 | — |
TcgLogHashAlgorithmSize UInt16 | — |
AllFinalPcrValuesPcrBitmap HexInt32 | — |
CountPcrsInAllFinalPcrValuesPcrBitmap UInt16 | — |
AllPcrDatasPcrBitmap HexInt32 | — |
CountPcrsInAllPcrDatasPcrBitmap UInt16 | — |
FinalPcrValuesSize UInt32 | — |
FinalPcrValues Binary | — |
SealedPcrDigestsDatumsSize UInt32 | — |
SealedPcrDigestsDatums Binary | — |