Microsoft-Windows-Security-SPP

324 events across 3 channels

Event IDTitleChannel
1Perf
2Perf
3Perf
4Perf
5Perf
6Perf
7Perf
8Perf
10Perf
11Perf
12Perf
13Perf
14Perf
15Perf
16Perf
17Perf
900The Software Protection service is starting.Application
900Operational
902The Software Protection service has started.Application
902Operational
903The Software Protection service has stopped.Application
903Operational
1001Operational
1003The Software Protection service has completed licensing status check.Application
1003Operational
1004The Software Protection service has successfully installed the license.Application
1004Operational
1007Application
1007Operational
1008Operational
1009Application
1009Operational
1010Operational
1011Application
1011Operational
1012Operational
1013Acquisition of End User License was successful.Application
1013Operational
1014Acquisition of End User License failed.Application
1014Operational
1015Operational
1016Proof of Purchase installed successfully.Application
1016Operational
1017Operational
1018Operational
1019Operational
1020Operational
1022Operational
1024Operational
1025Grace period has been started.Application
1025Operational
1028Operational
1029Application
1029Operational
1032Operational
1033These policies are being excluded since they are only defined with override-only …Application
1033Operational
1034Duplicate definition of policy found.Application
1034Operational
1035Operational
1036Validity period has been started.Application
1036Operational
1037Time-based license remaining validity time 129600 minutes.Application
1037Operational
1040Hardware has changed from previous boot.Application
1040Operational
1041Operational
1044Operational
1056Operational
1057Operational
1058Operational
1059Operational
1060Operational
1061Operational
1062Operational
1066Initialization status for service objects.Application
1066Operational
1067Genuine information set for application.Application
1067Operational
1072Operational
1090Operational
1184Operational
1185Operational
1186Operational
1187Operational
1188Operational
1189Operational
1190Operational
1191Operational
1192Operational
1193Operational
1194Operational
1195Operational
8195Operational
8196Operational
8197SLUI.Application
8197Operational
8198License Activation.Application
8198Operational
8200License acquisition failure details.Application
8200Operational
8205Operational
8206Operational
8208Operational
8209Operational
8210Operational
8211Operational
8212Operational
8213Operational
8214Operational
8215Operational
8216Operational
8217Operational
8218Operational
8219Operational
8220Operational
8221Operational
8224Operational
8225Operational
8226Operational
8227Operational
8228Operational
8229Operational
8230The rules engine successfully re-evaluated the schedule.Application
8230Operational
8231Operational
8232Operational
8233Application
8233Operational
12288Application
12288Operational
12289Operational
12290Operational
12291Operational
12293Operational
12294Operational
12295Operational
12296Operational
12304Successfully acquired genuine ticket for template Id …Application
12304Operational
12305Genuine state set to genuine for application Id …Application
12305Operational
12306Rearm successful for AppId = 55c92734-d682-4d71-983e-d6ec3f16059f, SkuId = …Application
12306Operational
12307Operational
12308Operational
12309Operational
12310Operational
12311The MSA client has been successfully triggered to update the Device LicenseApplication
12311Operational
12320Operational
12322Operational
16384Successfully scheduled Software Protection service for re-start at …Application
16384Operational
16385Operational
16386Operational
16387Operational
16388The current time is 2023-11-05T22:33:07Z : 2023-11-05T22:33:07Z.Application
16388Operational
16389Operational
16390Operational
16391Operational
16392Operational
16393Operational
16394Offline downlevel migration succeeded.Application
16394Operational
16395Operational
16396Operational
16397Operational
16398Operational
20481Health check initiated.Application
20481Operational
20482Health check passed.Application
20482Operational
20483Operational
20484Operational
20485Operational
20486Operational
20487Operational
20488Genuine validation data collection started.Application
20488Operational
20489Genuine validation data collection ended.Application
20489Operational
20490Operational
20491Operational
20492Operational
1073742724The Software Protection service is starting.Operational
1073742726The Software Protection service has started.Operational
1073742727The Software Protection service has stopped.Operational
1073742827The Software Protection service has completed licensing status check.Operational
1073742828The Software Protection service has successfully installed the license.Operational
1073742831Acquisition of Secure Processor Certificate was successful.Operational
1073742833Acquisition of Rights Account Certificate was successful.Operational
1073742835Acquisition of Product Certificate was successful.Operational
1073742837Acquisition of End User License was successful.Operational
1073742840Proof of Purchase installed successfully.Operational
1073742842Proof of Purchase removed successfully.Operational
1073742849Grace period has been started.Operational
1073742857These policies are being excluded since they are only defined with override-only …Operational
1073742858Duplicate definition of policy found.Operational
1073742859A higher priority policy without override-only attribute found.Operational
1073742860Validity period has been started.Operational
1073742864Hardware has changed from previous boot.Operational
1073742884Kernel policy cache has not been updated after Windows Right consumption.Operational
1073742885Edition changed from param1 to param2 after Windows Right consumption.Operational
1073742890Initialization status for service objects.Operational
1073742896Successfully matched deposited Installation ID with Confirmation ID.Operational
1073750030Token Store not found.Operational
1073750048Existing scheduler data could not be found.Operational
1073750049The existing scheduler data does not match the expected data.Operational
1073750050The existing scheduler data is incomplete.Operational
1073750051The existing schedule data is expired.Operational
1073750052The rules engine failed to evaluate the rules.Operational
1073750053The rules engine failed to perform one or more scheduled actions.Operational
1073750054The rules engine successfully re-evaluated the schedule.Operational
1073750055The rules engine gathered the following context data.Operational
1073750056The rules engine failed while trying to update the task triggers with code …Operational
1073750057The rules engine reported a failed VL activation attempt.Operational
1073754112The client has sent an activation request to the key management service machine.Operational
1073754113The client has processed an activation response from the key management service …Operational
1073754114An activation request has been processed.Operational
1073754115Key Management Service (KMS) failed to start.Operational
1073754117Publishing the Key Management Service (KMS) to DNS in the '%2' domain failed.Operational
1073754118Publishing the Key Management Service (KMS) to DNS in the 'param1' domain is …Operational
1073754119Secure KMS initialization failed with code %1 at stage %2.Operational
1073754120Secure KMS initialization succeeded.Operational
1073754128Successfully acquired genuine ticket for template Id param1.Operational
1073754129Genuine state set to genuine for application Id param1.Operational
1073754130Rearm successful for AppId = param1, SkuId = param2 - param3 Rearms Remaining.Operational
1073754131Skipped Rearm for AppId = param1, SkuId = param2.Operational
1073754132Active Directory Activation has succeeded.Operational
1073754133The client has processed an Automatic VM activation response from the parent …Operational
1073754134An Automatic VM activation request has been processed.Operational
1073754135The MSA client has been successfully triggered to update the Device LicenseOperational
1073754144Token-based Activation has succeeded.Operational
1073758208Successfully scheduled Software Protection service for re-start at %1.Operational
1073758210Successfully started task param1\param2.Operational
1073758212The current time is 1 : %2.Operational
1073758213Grace timer has expired.Operational
2147484663Detailed HRESULT.Operational
2147484664Grace timer notification failed hr=.Operational
2147484665Installation of the Proof of Purchase failed.Operational
2147484666Grace timer creation result %1.Operational
2147484667Removal of the Proof of Purchase failed.Operational
2147484668Proxy Execution Key has failed to load.Operational
2147484670The system has been tampered.Operational
2147484672The hardware has changed.Operational
2147484677Unable to get detailed error information during license consumption.Operational
2147484680Kernel policy cache update failed.Operational
2147484685Time-based license remaining param1 time param2 minutes.Operational
2147484692The following errors occurred during license evaluation.Operational
2147484704Some data has been reset.Operational
2147484705Unable to update Windows PID information in the registry: …Operational
2147484706Installation of the Proof of Purchase from the ACPI table failed.Operational
2147484707Detected OS composition change triggered license re-evaluation.Operational
2147484708Detected OEM product key change triggered license re-evaluation.Operational
2147484715Genuine information set for application.Operational
2147484738The Software Licensing edition check failed.Operational
2147484832Invalid chunk hash detected in migration blob.Operational
2147484833Failed to gather PKEY information for SKU.Operational
2147484834Installing migrated PKEY failed with Sku_id.Operational
2147484835The Sku associated with the IID/CID is not installed on the local machine.Operational
2147484836The Sku associated with the IID/CID does not have a PKEY installed.Operational
2147484838Unable to deposit chunk due to HWID mismatch.Operational
2147484839Unable to deposit chunk due to Trusted Store being recreated.Operational
2147484840Failed to gather PKEY information for backup product key.Operational
2147484841Failed to gather PKEY information for OEM:DM product key.Operational
2147484842Failed to gather target OS information for PID.Operational
2147484843Failed to gather target OS information input key data.Operational
3221226473The Software Protection service failed to start.Operational
3221226480Acquisition of Secure Processor Certificate failed.Operational
3221226482Acquisition of Rights Account Certificate failed.Operational
3221226484Acquisition of Product Certificate failed.Operational
3221226486Acquisition of End User License failed.Operational
3221226500There are param1 invalid license(s).Operational
3221226513Failed to collect hardware data.Operational
3221226534Deposition of Confirmation ID failed.Operational
3221226661Failed to read migration blob - encryption key not recognized.Operational
3221233667SLSetGenuineInformation in sppcomapi failed with the following error code.Operational
3221233668LoadLibrary call for loading Sppcommdlg.Operational
3221233669SLUI.Operational
3221233670License Activation.Operational
3221233672License acquisition failure details.Operational
3221233677Token Store found to be corrupt.Operational
3221233680Acquisition of genuine ticket failed (param1) for template Id param2.Operational
3221233681Genuine state set to non-genuine (param1) for application Id param2.Operational
3221233682Update current edition product key id failed with param1.Operational
3221233683Update Windows license and product key tokens failed with param1.Operational
3221233684Rearm failed for AppId = %2, SkuId = %3 - %4 Rearms Remaining.Operational
3221233685Activation Object cannot be retrieved from Active Directory.Operational
3221233686Active Directory Activation Object is not usable.Operational
3221233687Active Directory Activation has failed.Operational
3221233688HCI Marker has failed verification.Operational
3221233689HCI Marker has bad data.Operational
3221233690Failed ot retrieve HCI Marker.Operational
3221233691OEM OA Binding failed.Operational
3221233692OEM OA Binding extraction failed.Operational
3221233693OEM OA Binding decode failed.Operational
3221237794Failed to deposit Token-based Activation response.Operational
3221241857Failed to schedule Software Protection service for re-start at %2.Operational
3221241859Failed to run task %2\%3.Operational
3221241860Authorized upgrade for PID: AuthorizedUpgradeForPID.Operational
3221241861Downlevel Genuine Ticket successfully deposited.Operational
3221241862Updated policy param1 with value of param2 from Clip.Operational
3221241863Downlevel Genuine Ticket deposit failed.Operational
3221241864Downlevel consumption failed.Operational
3221241865Downlevel Migration failed.Operational
3221241866Offline downlevel migration succeeded.Operational
3221241867Operation status %2 with return code %1.Operational
3221241868You are on an inactivated device.Operational
3221241869Device is in grace period for %1 minutes more.Operational
3221241870Error occured during grace period %1 at %2.Operational
3221245953Health check initiated.Operational
3221245954Health check passed.Operational
3221245955Tamper detected.Operational
3221245956Error occurred during Health check.Operational
3221245957Genuine validation initiated.Operational
3221245958Genuine validation result.Operational
3221245959Genuine validation failure.Operational
3221245960Genuine validation data collection started.Operational
3221245961Genuine validation data collection ended.Operational
3221245962Grace timer initialization failed.Operational
3221245963Grace timer previously created.Operational
3221245964Grace period terminated with code %1.Operational

Event ID 1 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_PhaseOne
Opcode
Start

Event ID 2 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_PhaseOne
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 3 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_PhaseTwo
Opcode
Start

Fields #

NameDescription
IsLowPriorityInit Boolean

Event ID 4 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_PhaseTwo
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 5 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_TokenStore
Opcode
Start

Event ID 6 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_TokenStore
Opcode
Stop

Event ID 7 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_ConsumeRight
Opcode
Start

Event ID 8 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvcInit_ConsumeRight
Opcode
Stop

Event ID 10 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvc_HwidCollect
Opcode
Start

Event ID 11 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSvc_HwidCollect
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 12 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_ActionStateCollect
Opcode
Start

Event ID 13 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_ActionStateCollect
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 14 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_InstallEncryptedLicense
Opcode
Start

Event ID 15 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_InstallEncryptedLicense
Opcode
Stop

Fields #

NameDescription
Status UInt32NTSTATUS reference

Event ID 16 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_GenuineCollectStoresData
Opcode
Start

Event ID 17 —

Provider
Microsoft-Windows-Security-SPP
Channel
Perf
Task
SLSVC_GenuineCollectStoresData
Opcode
Stop

Event ID 900 — The Software Protection service is starting.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 900,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:34:24.586774+00:00",
    "event_record_id": 1585,
    "correlation": {},
    "execution": {
      "process_id": 7300,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "<explicit>"
    ]
  },
  "message": "The Software Protection service is starting.\nParameters:<explicit>"
}

References #

Event ID 900 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 902 — The Software Protection service has started.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 902,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:24.555246+00:00",
    "event_record_id": 1550,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "10.0.22621.2428"
    ]
  },
  "message": "The Software Protection service has started.\n10.0.22621.2428"
}

References #

Event ID 902 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 903 — The Software Protection service has stopped.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 903,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:38.447304+00:00",
    "event_record_id": 1583,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The Software Protection service has stopped.\n"
}

References #

Event ID 903 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1001 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1003 — The Software Protection service has completed licensing status check.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.803890+00:00",
    "event_record_id": 1576,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "55c92734-d682-4d71-983e-d6ec3f16059f",
      "\n1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n\n"
    ]
  },
  "message": "The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n\n"
}

References #

Event ID 1003 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1004 — The Software Protection service has successfully installed the license.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:49.517533+00:00",
    "event_record_id": 1562,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PRIVATE}",
      "5bb83ecf-2e3a-448d-be9a-99bab42fd5c6"
    ]
  },
  "message": "The Software Protection service has successfully installed the license.\nLicense Title=XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PRIVATE}\nLicense Id=5bb83ecf-2e3a-448d-be9a-99bab42fd5c6"
}

References #

Event ID 1004 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1007 —

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1007,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2016-08-24T21:21:10.000000Z",
    "event_record_id": 1635,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Event ID 1007 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1008 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1009 —

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1009,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2016-08-24T21:21:11.000000Z",
    "event_record_id": 1638,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Event ID 1009 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1010 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1011 —

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1011,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2016-08-24T21:21:11.000000Z",
    "event_record_id": 1641,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Event ID 1011 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1012 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1013 — Acquisition of End User License was successful.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1013,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:49.411554+00:00",
    "event_record_id": 1560,
    "correlation": {},
    "execution": {
      "process_id": 5592,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "3f4c0546-36c6-46a8-a37f-be13cdd0cf25"
    ]
  },
  "message": "Acquisition of End User License was successful.\nSku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25"
}

References #

Event ID 1013 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1014 — Acquisition of End User License failed.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Error

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1014,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:48:32.202000+00:00",
    "event_record_id": 25,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "hr=0x80072EE7",
      "c1a197b6-ba5e-4394-b9bf-b659a6c1b873"
    ]
  },
  "message": "Acquisition of End User License failed. hr=0x80072EE7\nSku Id=c1a197b6-ba5e-4394-b9bf-b659a6c1b873"
}

References #

Event ID 1014 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1015 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1016 — Proof of Purchase installed successfully.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:45:32.242626+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "c1a197b6-ba5e-4394-b9bf-b659a6c1b873",
      "88d68b6f-8762-54b3-a3a4-920848fabd33"
    ]
  },
  "message": "Proof of Purchase installed successfully. \nACID=c1a197b6-ba5e-4394-b9bf-b659a6c1b873\nPKeyId=88d68b6f-8762-54b3-a3a4-920848fabd33"
}

References #

Event ID 1016 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1017 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1018 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1019 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1020 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1022 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1024 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1025 — Grace period has been started.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1025,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T16:17:02+00:00",
    "event_record_id": 66,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "37L4247D28-05",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "10",
      "5"
    ]
  },
  "message": "Grace period has been started. Grace days=10  Grace type=5."
}

References #

Event ID 1025 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1028 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1029 —

Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Warning

Fields #

NameDescription
Data_0
Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1029,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T16:34:52.232627+00:00",
    "event_record_id": 37498,
    "correlation": {},
    "execution": {
      "process_id": 4876,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0xC004F015",
    "Binary": ""
  },
  "message": ""
}

Event ID 1029 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1032 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1033 — These policies are being excluded since they are only defined with override-only attribute.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1033,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.619160+00:00",
    "event_record_id": 1574,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "(Security-SPP-Reserved-EnableNotificationMode) ",
      "55c92734-d682-4d71-983e-d6ec3f16059f",
      "3f4c0546-36c6-46a8-a37f-be13cdd0cf25"
    ]
  },
  "message": "These policies are being excluded since they are only defined with override-only attribute.\nPolicy Names=(Security-SPP-Reserved-EnableNotificationMode) \nApp Id=55c92734-d682-4d71-983e-d6ec3f16059f\nSku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25"
}

References #

Event ID 1033 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1034 — Duplicate definition of policy found.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1034,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.616984+00:00",
    "event_record_id": 1573,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "Security-SPP-Reserved-LicenseProperties",
      "100"
    ]
  },
  "message": "Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100"
}

References #

Event ID 1034 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1035 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1036 — Validity period has been started.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1036,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.555440+00:00",
    "event_record_id": 1572,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "129600",
      "9"
    ]
  },
  "message": "Validity period has been started. Validity minutes=129600  Grace type=9."
}

References #

Event ID 1036 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1037 — Time-based license remaining validity time 129600 minutes.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1037,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.810237+00:00",
    "event_record_id": 1577,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "validity",
      "129600"
    ]
  },
  "message": "Time-based license remaining validity time 129600 minutes."
}

References #

Event ID 1037 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1040 — Hardware has changed from previous boot.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data
Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1040,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-01-28T02:48:07.177709+00:00",
    "event_record_id": 187,
    "correlation": {},
    "execution": {
      "process_id": 3848,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "55c92734-d682-4d71-983e-d6ec3f16059f",
      "3f4c0546-36c6-46a8-a37f-be13cdd0cf25"
    ],
    "Binary": "XgAAAAoAMAAAAAIAAwABAAEAAQAAAAAAAQABAAAAlit6tYoKAYtSyJ7WQeBuIiQd+a/NUsBiDQABAAEBAAIBAAMBAAQBAAUAAAYBAAcAAAgBAAkBAAoBAAsAAAwBACwAAAABAAIAAQABAAEAAAAAAAEAAQAAANamEuqKClLIntZuIiQd+a/ptaj2"
  },
  "message": "Hardware has changed from previous boot.\n AppId=55c92734-d682-4d71-983e-d6ec3f16059f, SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25."
}

References #

Event ID 1040 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1041 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1044 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1056 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1057 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1058 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1059 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1060 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1061 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1062 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1066 — Initialization status for service objects.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1066,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:23.779219+00:00",
    "event_record_id": 1548,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "C:\\Windows\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n"
    ]
  },
  "message": "Initialization status for service objects.\nC:\\Windows\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n"
}

References #

Event ID 1066 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1067 — Genuine information set for application.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data
Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 1067,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:49.567022+00:00",
    "event_record_id": 1563,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "0x00000000",
      "3f4c0546-36c6-46a8-a37f-be13cdd0cf25",
      "SL_ACTIVATION_VALIDATION_IN_PROGRESS"
    ],
    "Binary": "AQAAAA=="
  },
  "message": "Genuine information set for application. 0x00000000, 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, SL_ACTIVATION_VALIDATION_IN_PROGRESS.\n"
}

References #

Event ID 1067 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1072 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1090 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1184 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1185 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1186 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1187 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1188 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1189 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1190 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1191 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1192 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1193 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1194 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1195 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8195 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8196 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8197 — SLUI.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 8197,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:08.267091+00:00",
    "event_record_id": 1581,
    "correlation": {},
    "execution": {
      "process_id": 6476,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;Trigger=TimerEvent"
    ]
  },
  "message": "SLUI.exe was launched with the following command-line parameters:\nRuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;Trigger=TimerEvent"
}

References #

Event ID 8197 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8198 — License Activation.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Error

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 8198,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:48:32.513888+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "hr=0x80072EE7",
      "RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c1a197b6-ba5e-4394-b9bf-b659a6c1b873;NotificationInterval=1440;Trigger=UserLogon;SessionId=1"
    ]
  },
  "message": "License Activation (slui.exe) failed with the following error code:\nhr=0x80072EE7\nCommand-line arguments:\nRuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c1a197b6-ba5e-4394-b9bf-b659a6c1b873;NotificationInterval=1440;Trigger=UserLogon;SessionId=1"
}

References #

Event ID 8198 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8200 — License acquisition failure details.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Error

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 8200,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:48:32.202000+00:00",
    "event_record_id": 24,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "hr=0x80072EE7",
      "00010001(0x00000000, 09:48:32:133 - https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail)\r\n00020001(0x00000000, 09:48:32:148)\r\n00030001(0x00000000, 09:48:32:148 - https://activation-v2.sls.microsoft.com)\r\n00030002(0x00000000, 09:48:32:148 - 0)\r\n00040001(0x00000000, 09:48:32:148 - https://activation-v2.sls.microsoft.com)\r\n00040002(0x00000000, 09:48:32:164 - 1, <NULL>, <NULL>, <NULL>)\r\n00050002(0x80072F94, 09:48:32:164 - 0, 1)\r\n00040006(0x00000001, 09:48:32:164 - 0, https://activation-v2.sls.microsoft.com, <N/A>, <N/A>)\r\n00020005(0x00000000, 09:48:32:164 - 0)\r\n00020008(0x80072EE7, 09:48:32:181 - SOAPAction: \"http://microsoft.com/SL/ProductActivationService/IssueToken\"\r\nContent-Type: text/xml; charset=utf-8\r\n, <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\"><soap:Body><RequestSecurityToken xmlns=\"http://schemas.xmlsoap.org/ws/2004/04/security/trust\"><TokenType>ProductActivation</TokenType><RequestType>http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue</RequestType><UseKey><Values xmlns:q1=\"http://schemas.xmlsoap.org/ws/2004/04/security/trust\" soapenc:arrayType=\"q1:TokenEntry[1]\"><TokenEntry><Name>PublishLicense</Name><Value>u7vcfA07FX3foOdZL5/wyf4PcsewCGhrC1PPcf45mqjfmclqytn7rlUUNHCRNO0eVM4KnnXFnZKGdRlVA43lNY1uJycMif1KW4oYjUiXoEV7Bl56k2RoBv33OF0Ocs83ijddvocbAYbm/OEDQj3pqE4BqE2Qp2flA9PcESYcJkSNVeDTQbECAr3AhS5YUizF2SL68DZppSBd4V4Z5mr30B24TWkWTfzTO2pF1iTzYBHrcisoV2Qm4T8BujQLStbTeyosKEfzCn4ze/tz48s0ItI+/p5o4MZHIGX1q6QQP4s9Fb9gqpWDABooGCK9b1+eUNIwiHuBOrDV/wen1omKfjHv+ukug5f6KwnB4jOB9RBDRuivdjaLTD1lUfnWLbzkwAQ11jR0vP1I5aT2brGGKuXsUaHkRG8h6X8DJejn3I33858vGTeC2DcCLQXy2lNQ4iiz/ggGutZqVbqWXGdAZzeiz+zV9OuItWyBM8ALVJ3K58lfttJCv1H1n8v9BYlhptPCadqIDDtUenPOkGJVQwxRjCBvZYlE8o9nzgqNdt2tSeWsnmkYmwxI6hF8nkJjrHPRAvN8s5BWqUe0QHvxHU6HUeW1FBCPofibJP834XtCi0Auu6JYgdp4Qi81sUZI6riTdcOfcQOfWx5XfBfbn3678gHU0Hz4q0edcKgbR+ONZ/Wh0/arJ9QfDX+QiRoEQnY70+nkV4kw/f99phXogimkKfLZr0nMsU92oo/Ds+pUIuii29NzMXbIbR6jn3NWAO9t4ovjojoaA/NfT/9LUiwzb1PY64cjuB+6kz7+9QycUQlAQ9tV1LoV3+vs8Q/jI3Hkov84Rrmt8DriPHjJa3q0SwW/sulBDVZ2j8HBKRT1WGRaq80ZTmK6Z5en9ZNEIhAr3NWfh5w25Ke7oDwJPY5WQgviv6gxQzwnyJ97EIRTyobhxw2gKa6aciqFs1Tn6dqohzpN3tUrWT6B7UrgrzKdLBIbXpDUI8akogs4iJ0UKopQ+gmLfu7hF3LAuvBxSBOBD3AB11vtF55heh4+RaN2Z3EigvglI5CNnW5NymplxwgEDX+ph/Xdoa0M+TqL7od3WhqYE45isovu4KuYcaJ744cVUn04RMKVqPnD2Ss4g2E+qvkxns/AzDkDHa+42uxfXkb1tLKZcgwG2AwKw+HENIFEpeN+a1zZ5wDD0vZqfNQEiOuXkqF01AlsWbej0OEdLTgNjRSBtsEoo3tUuUN5wOs40jZY7ocZxY1bEkDS8WShHsEydLT855jZC/BsYTn2Cn+S70R6oW9g2mLU33o7OPHwiDQ20iNT7q0HlKF9SDSBvsGq4R2XXqky0rDPIhD3ueM+Bjkg2zTP1vbFxlaMpqeG+iTbEsICQqIbaTIoDkcf/cz7eqT1LICoKmMuGVr9eEPLQASSZ0/JvoDlajc8KdT4XM0iWuPG2FWpGkYdIg80wa9P5NK0ENiv51bfjpkB2GynyKepcRZE+KAyAPkFvGCHX5fn047HMr5y12ltjfe14pNaEc2p8WCNwt3P62fhVgtbE+tw13f1t+mxQPnWiN1qy42uhioAo7p/HTw+TCmkhuxIzCyl8tpDGx191qQRI0fCRYEqd8GtIpGeQgqVflqUqUk+CeC2uv0w7Y1R76dqS1ewK6jgC7YgNycIAGpuljqZuqCBHJEbWhNqGn9NLSzJQhT2d3R/5ZNWpjJL7xIf6JUIKkOSh2Nn/aNd/q6bVI9OJRgExULyT6694+TGYOePdsNKbVcAwSyp4JCqQ+YxHZVpv8mQPitV2HrQa5RaamJrbTXr9QeuFGq1InjgFdhNccOEKBxBnENe8KxJ7e8vTQiy2HtN5WCY8eRcYtiHFQiYe6AMuWq7Z+6NhRt/MOeLpby2J2oboDtuhIQ8Pj83GH/VftmKe8GIViOE9elvZbWWE25Gv4tkJSDWz0pciPxJTgD1vdUU44VTUt4g89Ve/UpLw8nf0b84NLdnCKr0YdycytRbfCb8bMOYnGCFhQ1D8AfC0RO7V2lAfrLX7Ay48ERizJti6zL79WgSbrORnjPTkIKjnOm3dtZJa6fBBlBxoM0hMah4bJnvA4jthrK0zIz3ICg/ZfY2+7ncwAwyDH48G9JVx8p35Cht7kU7zQIGmTqjjOG8PDxnzC+CFikvlEFIUE1d16s/EPFqX7jfYDzkEqVC5jGateqiXX0XPnf8s3Nwy0IC7InzVPrLteBGwW3e5on5uQrBvPhWFwrEW5nqTWR5FegOUlJ6io7NKVmkkQP30CaDwovbDy/gX55+4QRjcY/C5NIhrcWjByZG4Umth9c8mZWeR8vSWWQ9fXU8Z2Y6IUzOFum7Bfzm8QVm6S90/G6w+qwX89m8egX9LSOKhvF5M2H8j6fiF7yzwlRDSmupHl4gOS6zr81ytIlNiecNnowzTzkKHbQ6TETTw1RVaC2YLtfKNXzl7JS9g8tH/hNXjHSlRW836HpKSLvjUm1dCUsgVOFt3AKkeJOTssAtgpZ0cUP3Q6PnYk4neRRVY9j63SUFVNC/QU1Uw+pJ9nazDOeh1wAj8VeChOusqQAfD5z/UlvY8yd7v4Djx3PFqLR50ksUCPkdJhD/WQelNrg++Dw//jAQnMGTe096SO/Iid5txNAzO/TVWcogbU6fIPVdVcD+yB0WARpGykfpvtiqurFqIPq/gNwU1pB5C1jy3q24PCxAIw4iyuRkD7niDYCfeoXFRX3mQSJLFiTkVtOFSfd8gm9zEC2pQm1jSMM+5c/w+dq9EwwvJ8uE/kK+/ekYKKHQM2DQffzULtaKfm9mavY9K4P0qCpCpDDFC1I3By06v0c5DzIQ8CI2ng6YTUfPMLFF+aZBKBOY2hI3Pdkvg3cvvsc8RO2bi25JMCHkvo3nfrUlzBuaC2WeoEauwTBJjGo1lzR7oxl30p0sT/Z0DdyCMDuVZguoUQV+J2xqFOEmaSCjba0i0g2+09TE6jt+LVapRBDWcENimrWE+x8Lj5kap5dPsNtkM6ms4WpyCJUsOHhdPoG2PeBkNYdOtt+jI4Kzo1uxFSVe7Il8yEfOCgtRfMyqSBmC12GlQkhnojicn/ZZ/njVusroAxNTK7bmHhgrPENUALmb9ulTTyHdY35tQTkNzdydCVICeGhs7Ao9bwOuMp2dELbOwQ+h1ff37BPtF7DeyNJZep8pNKI2MYTSaFKrhtWLv0DmZinqttZHBNYonpuqCFKF9Z0bmAFZqS+x4EixJsDwsKJZkUZFeqJqo8rq1r6YBn0xnlceOWz45wDX/sow76ScBgadTSEPdobhhsdQod0Ju3V9mrrCk2PRAe/z8YgLBLiDCZg3m+aQdwgSM6WkmWiieft2toBmScNdw7Z7VGeL8iYAtrITWLDF27ZhNNa913+3O1gw0dQAWufv6jXS+8+EslhIHm01iK+4goVQIYmlCmiMd2hEaa/T5KvMDyJj4bUhH7pjhWvZyVuQ30Uj6q9m6jnH2Cc6+m7XXnU7pXCe5v1rZE0yCXRfPRVdiF2vkMWq36RFUcNiyAyZYv6GtYpgqAcMcmWC8j3VmysYk8gBzbhGpwI4Toq8ZXwsZjN5Z4miomYz9apDHFeoym+dIS3Wd0brjt7ASRvhCUeGCReqAsmoojpCmTH8S/j6PKsgdqdoH3FagNGYH8K3Xh5XxpnomaJEl2Y4AQqCOGr/jCdrw/P601x1ByeszpzVi+qNc+YLFFoW378DaPmGGldqOGH2pKbdE6yIEOkKpulLCBb/Rt4p4Mnerjd5k3Cd4Zku2h7p0DY5iwX0cad3N3VoUyU5SYxjW4OJD41pTo7N8/+G1mR0coXaIOXEeRoP4g1Ch9VcF7POoRn3U9bhIiD27LKRg7bf/O1fbGeXX3e8/8dCYW+3XmKuUNEbsSwPW2VniN48CQboseYGY32d4PZODVpSwDx/kx80PdpZvorc7Tg50ZC9wMGEpXYxBuQcx/4+7QKGGvlFnAdqwYiturxJp1tZYiP9398ZWKNT2288CpiI1kJmx1uq/44av3ZslQ98Ul5UzYIspjCLM2GZ/QlFcg+gjE1hgiIEPSbJDuvgkrg6JN/ZoAdJfy9OVAFoO60Br4sS1YlARAolkjDrAKfRnJiF87lD1jYhE1jRgkwsv1NSt18oIZqR1pvDGXb14c4/ijK7VDLuvsJLsv1MERVu/WtmUta8PKtotDimRt3IHd7/Z+Hr865SwRmggqlUhJIALUxeXUQEuj0FPqAS6V8Lurw6a0/QNmDLsI82hs+z45qQdiV6wP8dqbUu2/qsAvcdypd/M5U2dLnj57TGjEyccX9ZDZbEcbbFe34rg1oiL6q45uV9tpPFgD1mds+a2DVMYj9H67STdw3G4Uch/ge6kNyBnZfQyH33Ll1OA69rBLiBuF+fVKIT1dg5RciZ2Cl5umwfeL1jNm/VjRL05jiMjPqmS2YpnfxjBQMy6D0zgA2K/2pEIfnqj08FO6rv/pxvpsgdQ1HNl0u+4EwmINUv6guVKWrA+who49arStGCrN0UDXxtSigEokHDud1siNWQ0Cb9NHeuep42oCC7tbm/lo7uJeAEiPCljnXV4k38HBPgybdorc7HwshEuycJAUNtzqLRGJwHmTegOYW8NF40ddifAazhPzY5rtdh+zpLyJYOFxpmwB9ODYPDJcy3uigdC/wJt8dnIWl36Us0ziGluiV+MI1Rr+jrVtgAymVGBIuHN0hRnNkdTtIS2cNKavHRAZRlJBJfdSB4cpnzmeNmNkHYr16qMTMZNomMCx+xtZTWSRpsMmVMaHttfkxkvUgluShuxYs8llKzwPPacAj2sFfp7Ll6Baxd4pP6qgWyAkssofmFi9Wniv5f2M7VCZnh8hzKyGCttk43xKAA+HkGr6QzA2sulNbft/mYV3Wxdaz4YywqKG19RUr9OlCFhkFRaBrBYDLn1i2YVCq22WMSE15wa5zMrV9eeZ1ky1LkU/8F4BwVGjtAhE11ssNhQ3Sg7UU7cBUSUtNHYcrbOgpHSJCkEUskxZAFwB3Luo2KKRYSstflxbyersUb2a3L2Y/DoGxxOXzS9ftaoz3YLxeoChWbxRCs7vOXCINQVMLewEb5TCJRsW/CgB/+4hhYLdweka4F6jZAZldATQ/6agDjYcRApoBcSmX3hPGSGxT5pjGyRLvMwI42ztC1nrZJ4+s3hPFXpRl3tNVYucg36eljbF8ZT9KUHh2slTko3+esOWcgzaqAAE0/U69PFQyJ49c5F4FZIgoXU6/msvQ08DqZHpWO95ktSZ+7CXDSm+g2REd6U155J9q2g3/kfbqxv7Ndt3LmP3/ibD5ahkSs50N6u5vRSlb7vSFFEftwWLdUij8erUSc1Sae6C6mcqM13qvBcWhiaChxfKrPsRBwEyzgQb2CijtX+D317PIY1vWZh79oq/O+W8imBUteK117znc6m6Qi5+rJF3KeRlAiEM2R3Zo3VKOovewsslk8OIY290Prte7QiDEn8YiQX323YidToBhd6g2iAZ8TDCQj8kFLOih0fy3Z5wD7NIoOWt/GcQc+2l2Tekpeo4yaVWLroBgg507wSSP1HnzQEkIcXRUrNYR14q1xzzAEYg1aOPU786F5fr94kIP6EusiroNWNgElSCvyJMOeg0odOyUlZn9BI9OQrBvKYch0S3Dao5qqc99xEFM6pG5iFE0bAjUrr8oOBITyYK4YWwj8j6tX1V6eOuWZf81FnEyCIZuder9NaD/smpVRCmbpnln468L4rRmAsnw9JIPpiUi111FZKeR+mrkKjSKusgN0NjuRVIYHhaUnkUO1FhdlYMYWbiruZjhBYkK9yZlLVmZYvyyJkzzW5SmtRW+PY+but5T+IJLw7+i8sAt3K/ILwZV+wZ9fBaBMuAkozd47Hta+VUDPmngWu3v83vXRffJq/nPfc8z46v67HOjCFOgzDt7fck2eANtF5UXdVPMuVhoVQ4AFfKANnWNS4KQgoBvaendKZoOR3NE4FPNK0S93BkqE+zwMf7Td5CLVwwH+13AQSEjUuSz0Qmvw0CCtm9zrn3P9hL69ylB5mwQ/IxZqyqfNH91rKb55EjGUFatgO9wNZA7hJNQGoF66gdzUX2Tf5sHBRt6LDZCN1bYyr+dG6aR53f+kerAQAR9g/PKns+sPrj8vg7OGCcfNQEHSVuy/DgemtlfrOV3J3bbS2JRLCETYCJQx/eKYNyToSdb/IuMcWXXM08YVA8Q6Y0sUQfJvxRL9ItqZ/TUMCdfCOmdgadhqgtRlaf9gr8pLYnyme5flUc6xWqtKxvfyC14HStFZ/r/voHE743K9SciBSwPatg3zZS9Ml3nwYHUZXOq2I/KP2VS0RJT6Gxl4EbRJconl0uA92tR/9alc12/6lH0BYngkJhauJ4XU28eZc09VHqunfqTgg8dZqLb+sMWtdQtuLHEiFweAVXIo2LJGrog9mbQxzX3TlvLHWGyxl9Lw5JvQrnc5Pmh/MCXfPYYIXl5nFYhE9RrNKOZq2wxQimw/FfEn0tG7GCCIfYctnt0w8Mi1Am4MxayzRySqu9684gH2Owr0lPGZmOgynWKuStJBQK20Wpz+DdqHzI+YoKCCnt9sCf9Hpc49EeRmFR/VuVmN3pOmUwSm7kbKUFNzxuGm0Nt1Z0SnB1B1ncdxqrJCNK2Z2+83ngzoW3iQaK6rnE60lwjI+3RVyClqK1O1AwfTOXZsSqM/rK4qe+iL2HsFRDV1/c72eGyVH6bdpuBVdznnuhK1Mth0Gr3R+PcQLb2uWnnNWIryu5I9kf2fbVfEaUBGFGHmEIbSfc5ZKmSbQz1KAFGYbKAtJnE5fRCdmeyd2I/32dNlE+XLp1iEJ+aO6F5et6xx/uY9pVYotBFkJZFBwrT0xNGBxzsxjnuU8mTgXePps3d2KgTuQIvwd4aSiT61ph7Hc0ct1V73vjuWLg6KbdxGr2fkMgnhseP13JOL35h8gc7E7W8F2RIqOl+DGX5tOllxFcQbsBAbpIiXaZc1HWQDElzrXGTYq06QPDS5stmKNgjyc9vfm+Z5MJbrEgRHu1EEMADIwMB9KjotjoOF0GfE65lFURXo8okBoAtbF02GBx4Q8pqOr4ZvGmp7089O8gKgElla+NLcIP+HKZnJCNeW5elavG4KDgjFUu3A5wyWqD7wulZdx/GzxMJXJSWq45XtITwI925MxuY3LF97Py6nguoQSfHfwO4IoOPoXzstActHv9ULRf1iWkqOMrWa8+oGuZcqf40UGq+d/m2ZZuLCMTzbEPR1kl66R0CMkEZDaopeXbkXVAASdtEOJii4ea8zuA9tS5h+b9UrQgoUyPWjiZDOiREPuEcNKyccW5a+DLZ5wHOIlUQNgXpzj7GIKhZADt/u8bCCKfQs1TXxr78SnTl41StMqBdkPGQ0pnpOD9MHS/vOYs7O1ZTAZH4M4MiEV7hiqYpWVz+AllCZI/1vpkmUUrmUV+2JhDLOUOQNiT4DZY6ofaytHzX9rl98oizKYvRPjuc9eeWKJcJV7cT1oIinwym0YTpipfoHVIc3BCTMtCi082pwll6uFxYJlG+A73Rckn+r51EZkclg8+7jVdGxrnRqO6ia+9qE5coCtv2PH7E9x1iTGZKGQeWilTbq6t9XycUr0BIM5OfsSlSbKKWpwgm85xbytGScLgj5un42Ns3PJPTMAxRscekjKysUEzhR8yzOIYf1jUlJ73AHzc1qG4rSepRQjYoMR1KNSuKpGuugHRAh6auIbJ287yLvz/JXjOIcEEiP4L407lya/unDZmBt71R2MpREzHcyQBSLwlyL2qFKfjFSA/9Ut/+KiPH5R9PgjcR4gQXRCQXgD6k6MUaL+Mj+BJ3REM9hu9rjGq6C+U5KR4KcvfzjJhsMqi2LLJJnXOmgkyp0RFDtFxDG5o2fgizQ+0vAUC81XxXPajX+uVHT5uTaaVZoiKTqQa9kXoQG2YY89NUs9XZ/wer6IupIFjFEyoCxQ1xFUpSjH/NYkXmCNohUDURW/jBdVk3Z5JF1+esRMLeTlitnyFhr6W5eXRIIjTCtzmNjX3kIc8yO2dEx4Sg4OxU+xmFuEPuUXS6xeT3wYzH8SLHJh3OJqdKZ01HIi/75gm1d/cHguqA403ycIHUivGFmB5DJlatSTYBLZzHgxfiYZ53eHdxiue1LfhsFc9YDr/YJXZUcY0x6C1OlaUvjE2bYobZwCc2UxMzjaG3LQncjSMyJYID96rmkGT16AL8y0kKO1Qi/NSc2B7qduhUWm2jLrIqyUxBZ7VQCpgQP47ns+rqRBa5JK8PJ8GklikOqNeAZ4zU+3lsIAe7NTVBMVXcjotjhWt+M7VCHWpsSzM7aKpIO84hZmBhN7c29iLeL8IJTwEQa6mzKhBi77un8Amxo69V2BBRaYNC90zAIKIxDqDvYhssTvbHoRq7ekaF+mO3NcDz3tjNZzeee1ORmqf+4XJyqM/ABYrz2K2BtHZxzwxfahKF/6FL79pVvuhD+TG0zmj3r6A8UFK0Z8a9Tpi6IPJk6zu4ivyRV+ixV6uFxL1yZUWbZ0JaNtl0rLjoGmSWxBN76EQoGvLhrJNIdKMiQ24/oZAJd3NEkgVo3kQObEX9eUzjtQUksIxdttDqN8TTKKYseUtxLnLTX5hp6GRoN0wSFdpTTp1C6GazupwlgWfxskQOTCZxXSFyyIIUYmd0NHTBx+kwZJqYy6Sck2qQgMKxJvDI60xBecgclFgO44UQGOTVDWmgblsajnNgNj+slkkqOTo6M/VZ9RDOvmjJpHtIJz/EAxdHdvNN0TqO6kVa2tr68n902rMplnQAmd6AipwA4Jsy8PomhPnAKDt8KV7vPLLEJoyzeCnPmBFQh3+W234vg3BjwewRT+Dc8/I8zTKFSoRcp/6x2Minlbo7Z/7Lpg3N1AC9O2vEopHOi0JoWVnhZMmojaoBQFNg+2fRJEqVYBR9Ce6rx/Ng2nARoglS7hucHlM9TMbmRFxrRL78JoBY7pIhWPe0YYVwAqzapGGY3uAmL9xEgn7ghZLcdSFx0CFJv8TGlFseGGjqtVPs/rLYk1oqZ0kcS2dSPylvhfP8v1oom++0uZQ0ejB7ln3W3nWzwWWEp21k6oPhCTvTXjnlREUmwnhnMLG71RhN7Nm2hqQj7470DOGqbfftPxzVrL7nmmOI4kMKnD6Jm/VVLLr62uTCU67Hj5mSQYgHSuOz0U1pCGERbqY7yWtHtQ8RIgMR4fYW/nqpCheumMDyAei6LXwHW0mEu83OUSfr22O4K8OkmbFO7xVJ6/hJ6NAh6cJZYYCtUkXDs4aIG8nKVdkk6C5iNhuC47AwuMK12UEFSsJ/2RkDMO/4+62DoGS6k1x5+sRYB3x72mj1mip/frgYovWXq1wv0thzv5E9pdGjt2bvBtkaOB4zI4v71rBdG76nPTlkxZx9YerMSRAOvpSpan/3MlhqJaqMOvUcLq4K4eFqvV7C23TjKRItX+zupiIbVHSyjKrbgPPAS/AiZHnzqqRl/I5sgho/8rEwaY+dz262qrLoNBzlh0GRh/u+meN4p5yl+k65KOzGqn2s6vHJ04KJWQPoA90Bqcyi7SQAKuASS9qe3VDxHGGvn6zI9JnB8QTK6gDTqQjOIV5nwktiv55aP4JjioxDOySo/yEtvPSmG9a+r7kEr8p9HNyUtPqswzakCR+5AQsbIZsY+cz1CvZdugMxTjZAgupxIMmXI756xjWATwzYLq6Zvi3W50falqpM47VMWvbI9Xb6f0gNmFY0BPrUjQjDHBI8+G2d/yEZ+DMZpRn7nXXOTlzwYrCe2VxR7mYuXCnwtBBJ2tsqmP85W/NlWeTnFuhLV0LItDMio2e8ubRqP4ahc1FLdRw2Hgyo2Lm6/tDW7NgmICbmLTUjXWhaWFZTq784xVy+xnTYJBaRSPt9mYYkIp9TNKDYZwRHSjU1U8GmHnKVnW3x/xk+XATgFNNgr47jpcrnOjGHX6TLTSmzStU/TIi0xBk1S3FDzB3vfdJkEXrCwf2Xlcu5nGRUlrYDafthyuy5khxEGnYHvuekWneVsC2b0SaI2rv3WM7yHdgVbz+DL8d0GOmLLyCkvetPAJCYr+ddUxqly0FX2oHxbcPMiQG6YaJa78BFk8Q03T2kbfbnDzYYkxQlMliL4mud/KPyRiuPiGLVCm6xMgjqy8xGuiHAalnunTZn4I5MzRyT0EtopKmI/+WXWsxL6Hb997SPKQycwUMETQNurOGt0jxxMQvukKZzTZN4TAD5wt0RNklM+lKCKuc3fALFOPaSdcSOMO1Xjddtf0yDRc5ht3WkIobKBzD5fpx0siRyEiUQogQb5WxGaT/CYk9RpG4h5UyG4HLQ3WFC6/i29NMCkxxlT33OYXdzxVphj6U/VISSMqoCZmB9+fNvXjeo1WHTG0GbhwsDyb10pG7E8u9oagVm7rniKUrVYZCj1waWwpOeWB/P317L5Yc3mk8CuiI8/7dlIK9o62WbXfD+02qMWikEkDoAhqK6QWnLkyyjvDd1amS5ateFzTl/TPZOLPyHrByiOPKRXUKiiCiNR+5+DpTGv13KP15vdUCJiZejX3Ykl+G7otCp3mfBouTp0X5wcz3Z2EmqFyW3WW+kT/S5p9EWFU4X3kKuXHzqpInFipTS+jr4qYOVlinuSkI8rFaCwQ4Sr2zHnPaCKuLwbyjlku7eV6rTceHKhhMjcgk6pnBu+iB8RSyhDpcownMtT1XPIV7hG5VYkvH5+1bceuXa5muYyslPhP+y6fTMPHt1wKqZjZSwmmw/a4dEZaeKzTT/HCF1VQH3I39Sq1Xj41pZ/RBWfjPr/4QLdts3WuWE+ALmvpvfWC+BVL2me5IVk5UWA1oyWAvs4+gSH1XDUXTTmlm7SxfeuXAYTvKJbWMNmSPzoMwzb4jZpQ9FV+DqSDpgjkMkti9BFsymB7nnbMcd/RaPUI7eTqcic61Gmv8SiKODr91+jR47NMbr6relAgtu8LP/NthFBKGeidtsXzrB2XKYAMu3DbL/vVPdn9cvNJI4I0o1XuuqKaOqlLFIOCpgdKBadA2Rh+1OjSPlxjpl4tIpT/JzGxjJ7UKA0+p1kuHazuJxSMUBMHw6YSPhcaY7NPkjyeeK8UknvJUEO15ihIFDDsiTXbk4SJV9B2KtAlEcYCCHQcQLIx5jlo+3LY646p1AcabaHcaJWX7yDPAwJzW22QU8+eVdnJKcF0OCisWecZf+1U5U0GPYUrlMEjju7MP/Au7aYDwLY/G8wmPePPVVgZXa8j+SL3d0mF0ErGmedo3KQ+dSq8Qz+e2D8QOmb/vPbN1MrSfYWc6Se21CTNuRoXrkgNQ4zC60ZvsxXSjdwm/kMr+uKutSttrpXlgAbAcNBh6rYE/n0NOP8g4Pd1Z1PXKyOvlpIZL+qd1ucKMGSZf8LGk2kxMTHz1r6LrKfQMaZrUOkCD7E+8IBJfM6td1k1yef2xMz5FtOoiFA0Fddf8R3KjcHFo3FjG9WF2Q75kO2JwoFC+3qTZFfUgAU7i8gOdT/lIjU1YE3/hruJW670zDouZE5T39F+x/y5w5s0HmkTSANqOf8rLbJCjCvD256rVk+xD6QIxF2eWi75Shnip0IFUmZbf2EibedjfrpGIXG5mReY0ymiA2dXGE/V4KxgIkFnHLvuVdfGR8OjWrSeU3e7yHvhOqwaU1p819oqgoe1tXPyX+WKMA9aU+cwmR7Xp20OztoF+CWFjCHsArW6T4GjAxW9IN2RZm/0rwt3RpdkRjCKc0/W6rZvDzASYbqS/SE7i5qP1tdA0KYjU3hZNngVWXubNOOoNrgNtKGq2Kk/pEbGe9f8W1KYrOHX4i0tox31HwpD4cH+G4Bp47PYrrzFRQONUUY5iaSGY8E5QlL8tbrTy1IDOgKkoDIeLExpDb2r/hXv33EydaLeWUGw7AE3zRioxXqcpA67KxSYQF9TMP+EWOBVuNGOn3aSVpwi+bOmEfgkMdOTMgh0f/GCqtiP1Rn+z2NtQPY7LeV+HbxiDblB4IShF3ADe+ZaWgctUD2OkVN2woiErizbVX3VvEGYbKGuUScFMYln5k12xrXTzPaC2CiJugy5FZarCKfc5bMYGxr4qJNjkwbyMjr/fY0T8lNPvGNwmwyVIFBKGJwE/3RPXL+Pq8s1/F6Ny5h5/OovNSUL3RT7NyC7i4kO0Xn16c6RzEPpGxdwN8EZE2Gp+2p3RX6OeNAv4YWpuxKgv+2eu2rg2kubcvdQYkkM4OBK1iVDCrvZfSXmC5+EuX16uEAd5Eu5wpFc9dkXQODO6hAUXOmkZOE1EP+rRwISkRwVXDNTbVjcabqAT03Xoqpm9E7RIf98k+tyhjgB6bHI+qOMLSN4TEMOCrgUYdzWVGhPhbI2jVS1GrRusJlah/ynU1eVLLC9t9k6ATuGNaBbFiB8d34e0JYRr24yPcP+LFcCcOIxTSg7rP58k4iuc412x0kpMR1mDISUX4SSd1HNn9C0xGkUD5mSNMUTs8QmI8ZZbxWPzLbyIqXpV8yU0HOh2rHPHcI+J/47YoCH8Z7kbv1u06KvcgOZqKMKeUKc5PcxUXcXKBxVaXum6xenP6GaOGMeJdP4Y6cNMPBLX8S3ClQmGNLhz9DGGC2+Wy8cElX3tYsHl9zchedccU1OjGbmDd0CuliNm2VMax01yKQrSDlFBDXPfdzimujSsjtmgSUwcfwagBAacw7dqwxFFgAZg4V2oUHJL8ZbdnnYp9MOFsPjguaqltICdhdP09g1BJUkerfIhSa8U94VJEwPZIqlkK1xHzFrNLQR/dlGlUeV770Mx5zSBTOsDRTjx5bpEjBlfz6z78bEd2K9algmRwZEOi+qbiPlf/gHr/cUInmqAlnzFUBtJ50J4iczj8mMCbD8NaH2IX2i3vVwEeDlIjCp0RryUY5GpShNj1OUP5D2Mx/1uPM0PjmPJVyrF01XE9rGOHEcnHcWpiTdmOkD6wE3ROdhFg+wmL+gAONFt+Hq0vVsOWMi4vvC5QDzx3fJNXw2fzWJBKV6alb1+5IKBfzA47PcHiBP80mbhyeFHc6F7xCmyS7LNCz6+Gfe1NK1MtkCsPxCqSg7SrymFi5XKRwc4grJM/VmWJkf+1gVmx/QQgAYJp+IPf6nWpdB4SDpjtXbsqV/QIoYaKv5zkOuIKvYXSCGkybPcNpeOsz93rGZj9n54a9QND+T7yVNn0Hvmq3xRYMAySe36PxEwWmZutryuK79Oi76C61FM1GbbzQPZTzl6Xkfqup8sTmNm2cv1d1mBFPDfpGiTlONo7ZuDzyXpdsUZR4mtRVJ987cvl2vJzGO2MhHidOIW9BVI75s9uJiIrC+/dS6w3m3msbQF0vyk6uIgwlZ35VnmM90KaYN9pnC1ypLOIlYyFX/e2NH2xGKqieYIMj3GWbDmvj1Mzw1UU3QhYY0fZXYgOob77cuvujE8Pv+GZwll775ttmDiUNuhemHdGmepTFLW7dCGq692rFKQzsmHH5EFOvCp+uWZY39fW64eubHHVrp5z9HrnoZQd+gpghWFOFIJmohvXYhFx6vLqeE0B9ZUkxU0wbiQRXfMOz93B5SARCxb1coZ6pcDZLVsNBHFmMOxQTOutdqB/DLd7Egia21b3YcF/nncTjsjFHpukFB1OPdRzUL80o8/8PHbXz4ZBws2yzQ5G7Au06Me4SnV3MtfIbIQQgBVhP/kGc/tXDAzl9hLr3pitVtIIo00aqbCac771ggKLgYwkcXTdK7r+LzuAWZXSHGRK6P4y6GHuW1B8BlkMqoF8PdbY2B44kaq0crLHUAODtHedBluFQldaxhLHSyz7tWCMeSsBBiqXkdYZt+OzhW0vAEU1duvzbBmrp3sHM6MXhH2QXI7LjK52Ddyz6v/QMR0SrnsDoWKRqaWkKpr9xovHPqzgBhte2fwhfZOIjOssx+dZWY0bflX+BE6P/Zkja4nROs2p+zLbOMvLIjs4nfYC8TMXK2H7FtH5dSOcR6nrKlN09WJV1sjGCo8+kamT0VjEdmXTUGAeZGcR3dv+TCFhoKRK7Egb2McqYssg46LMQLBsAp9VWa9kbNExhEDHo2KxjwqUltleCG/yOncNwSpfeEI4Kn9YPyWIeqsRfPatdwN5X/QX693g512jthlsuZR2YslXqjmORD5U2lv1PlgG8rdBPwOTOGMs8s2MwpE+mhp2O4vybu/CtxZBslURCot5GIoWA5vv2crF+w+RjMxVvO/+Bj2N5U0cicYvd7D5x83/nYlqzCGnstByKu5BIOB63ZYHPBAs528JpktcAh4nnoluTgJNbxaQQhVxDaXvN1DWEA70K8Qt+uPXRsui768CFuvFNxGY2WMAU14+77/lTK3BOfVzjjfFMNhQGNkeuvj3IQk42nDKfGq9DGb+S1V31KXNqNqFw2xkJHlE3TcfCUc248qA3+Lq3rK8+CqohjnLs+YXLT9bUs/0t/XjJ9/X5/BYPE+kFFdWo8ItcoWDVW+WHp2ffhDDcu0c8RMogfAVsa+xWpOW7IzKtU3CzbsBJfcJZal8z/2BzR+HznjNzF4K+cdpB+UNZDNI5NgZoktb0ucUahOnpXR7LJGt38YmDlRxduaZWO4ui7U/N3i7cX4K6n9mDSK9L2Ohf2ewj8BTtwe2pIfLewEHnnt9b+ZcDNsBgryXVotbKbTf4rUTbPl++KJ2IFrp0qB+tA5mEmOV7LTdP0irPSmKqu0ERpbXuh/FzO09mjCJvkGq7c+PplKOlMuGSrMXeIvTNKBTfo5v3yC3x780LMAnBkn8WEeTGJeQibluWR/XpW7mGfeFtSPwkUhpj/SKN+9zXXVu62nmPrL/FStcrad6M4AmGnsG4rZplBmFgq/egPuZB6PrUHnh1EJXzJkhFYedJMCwelVG/DKMwMNLEwTpEE6G4dwnYuKoB031U0yVYZveUQLdEYmIaHte4weSyiXQEML+hBwvh0rmqiZhbfWmQAbb8Tt+Eb6pnKvW2pOcg/Qa5ZdKkQ9Hr2XbDkbwVzNJMwDiQOOKK/ZRoBeNY0rAgNHRMgAfZFzRZuwewe8d+YOYjkOXLGxrkJQVAMIwHXVDlAZVsJybf42M++/iIYXy1J2bW7s4OjAcS6OrWA3OCmj2zQ5NWxWpccKks/ia0lVD5hqUskMfgS5IFX7ZqJq6kNSYWGfBqzifFe44zluWmiC10Y+UMTzK9b2OVgrPK3OmXC7XguJwPLYKWuijfQoI144z58SasWSQl8Fjm6NWPszKtU4zRh6xRuLOkTB6gLxNLLgk3tKt1Wf4wCS1PJotoSBASggRCAkP3ZFFlRG+OUHP/ii+yiTOnG99hd1Xi10EYuvaoZdupxLY43UejyF06LVAzRVBTkqvroCpzxgWtO3j+R6pnk6fWCeFSXntaduplQRXnCJDekfrst58TP5SoAsNNEmYEl6tA6O0s67aatBsSUWipOCY2fCthumRdbxYRpaBWP1OvGYMYsWsbWJiPDBkI5z3nza7NSaB9ZWF00ujCEyxeaEE97thxIPjUicqcLHI0s8+jv46FBxtvHQxnKunadwBL45bUsAyaabSCBrIalOxyq+7mN/CniX1VKEjxy4d5bmnR58S2ayzu0fvF3nEoPUKJSMtqNhGS2ZInb7uj8MBGgY3TCYm+2aGjAf6tjSnmkdTZVyXE9P6rE4Kn32AJ8dOLAMUYkcq+PbfKJvRq5F2Tetjpg2WBQ2OgDTRFkX8c5Ut2cIHAx+n8Q3GT5Yt+omBUaf2sQw==</Value></TokenEntry></Values></UseKey><Claims><Values xmlns:q1=\"http://schemas.xmlsoap.org/ws/2004/04/security/trust\" soapenc:arrayType=\"q1:TokenEntry[17]\"><TokenEntry><Name>SessionKey</Name><Value>uHBj7mNfx54QXwSlx29X4BV0QHs+WQjOTt3/bC1Y35fnSWpMAEx0UWjuEAe8W99gkEdyVZJtDwvnjdZjt/1H1E6HY8OyHBnVgME+eJx5WKEO8GqKASmBGRl2TwJy4g17yvDsN5Fs4RfLxF5INsPu3s88qeJrAUOyYb5YA60I0f/N971irOAZE4WyjZXKJzozk4w+7FfhfephTfZojLOGMNp06KTJlnVqtQkE3fhfsZB+GLeRizhO5tFMODZllFjjsBKrFsMKpoFxHst6EvRvrgMPnz1laaZG7KJt4ncaCaXW/tWspdjzUUZKS5hUEpbwGEazQMA4q7NzENGqK1trfg==</Value></TokenEntry><TokenEntry><Name>BindingType</Name><Value>KPANBekX5ZqfaES093W068d41ru7Afy35FwJwS9EgS4=</Value></TokenEntry><TokenEntry><Name>Binding</Name><Value>u5isq6QfbLfcVglX2yG8unxJDyooJJILridy3f5AmxbMdGIENMOFTTDqojWJUcj1zeDyDY2z8ECDRKspPGltKeZCyESt2uk+jmpRPOiH3Q8=</Value></TokenEntry><TokenEntry><Name>ProductKey</Name><Value>gIVMS4BtYFTjFI8Fj4//in1CFVTxGUAIbuevy4zC+5M=</Value></TokenEntry><TokenEntry><Name>ProductKeyType</Name><Value>KPANBekX5ZqfaES093W064XICt0sbhcAdyEe49DzAh8=</Value></TokenEntry><TokenEntry><Name>ProductKeyActConfigId</Name><Value>cL1TFfsO04qoucXxpvCjZgAHDxNzKjBPbSLO56hhWSGNKfKgpefIGZq3m8W7HfkKeuqfFin7qFUKE/VAXcgQhfHcymcKVNZwqi+aWRN+mF4=</Value></TokenEntry><TokenEntry><Name>SppSvcVersion</Name><Value>VijVCeJDeAgyLBxU8RhzPQ==</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.licenseCategory</Name><Value>2WicPaigFS+gMNKWQUVldN42uNVsVc/TNlB/i1pl288=</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.licenseCategory</Name><Value>2WicPaigFS+gMNKWQUVldLNjvZxg+ltMeb2ZhfB6TOE=</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.sysprepAction</Name><Value>XZQaWleVvueSqSND+f8e1Q==</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.sysprepAction</Name><Value>XZQaWleVvueSqSND+f8e1Q==</Value></TokenEntry><TokenEntry><Name>ClientInformation</Name><Value>/f3yo96P+FJcw8TzvFc4+bgG2bRRMCMamxrF188eYYW4QICavdiEcsqW4qGPxkEPD8YIRMyCugad/uOy152Zdw==</Value></TokenEntry><TokenEntry><Name>ReferralInformation</Name><Value>DzaLfpCiDEgpdBmSHkR1WembpQ6n2ZbUKCRGnyjiNsiTFAZHqj5n3N6Syo/KLdnDX2tCYobSFiZk6SIe9EwqEg==</Value></TokenEntry><TokenEntry><Name>ClientSystemTime</Name><Value>SQx02I0rvwVE63YKuGmWGO5OByrr5xz5ZWnVvrO+2Qg=</Value></TokenEntry><TokenEntry><Name>ClientSystemTimeUtc</Name><Value>SQx02I0rvwVE63YKuGmWGO5OByrr5xz5ZWnVvrO+2Qg=</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.secureStoreId</Name><Value>idUbrZox6cCjUQ4THgEVckaOXyaI1Y9dBPdfycohwCFGYgJbfgOVwqcVd3sq1QfF</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.secureStoreId</Name><Value>idUbrZox6cCjUQ4THgEVckaOXyaI1Y9dBPdfycohwCFGYgJbfgOVwqcVd3sq1QfF</Value></TokenEntry></Values></Claims></RequestSecurityToken></soap:Body></soap:Envelope>)\r\n00010002(0x80072EE7, 09:48:32:181 - <NULL>)\r\n00010003(0x80072EE7, 09:48:32:181)\r\n"
    ]
  },
  "message": "License acquisition failure details. \nhr=0x80072EE7"
}

References #

Event ID 8200 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8205 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8206 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8208 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8209 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8210 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8211 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8212 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8213 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8214 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8215 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8216 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8217 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8218 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8219 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8220 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8221 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8224 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8225 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8226 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8227 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8228 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8229 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8230 — The rules engine successfully re-evaluated the schedule.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 8230,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:08.097968+00:00",
    "event_record_id": 1580,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2024/02/03:22:33:07;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL"
    ]
  },
  "message": "The rules engine successfully re-evaluated the schedule.\nKernel policies:\nSecurity-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2024/02/03:22:33:07;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL"
}

References #

Event ID 8230 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8231 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8232 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 8233 —

Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Warning

Fields #

NameDescription
Data_0
Data_1
Data_2
Data_3
Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 8233,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T16:35:02.726112+00:00",
    "event_record_id": 37618,
    "correlation": {},
    "execution": {
      "process_id": 4876,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0x8007232B",
    "Data_1": "0ff1ce15-a989-479d-af46-f275c6370663",
    "Data_2": "8d368fc1-9470-4be2-8d66-90e836cbb051",
    "Data_3": "TimerEvent",
    "Binary": ""
  },
  "message": ""
}

Event ID 8233 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12288 —

Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data_0
Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 12288,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T18:35:26.643586+00:00",
    "event_record_id": 37766,
    "correlation": {},
    "execution": {
      "process_id": 4876,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0xC0020017, 0x00000000, 10.20.24.1:1688, de742801-ad82-4fd6-b3a9-902fc671156d, 2026/03/14 18:35, 0, 2, 43080, 8d368fc1-9470-4be2-8d66-90e836cbb051, 5",
    "Binary": "00000600E74197F2BB2CFC7793C7F21C8A4B574088A8A9517480442EDB2FBBC33D6C70F959A1FE7F742DC82A2E72C2D45007877239A0AB652E09D813E51E0C2178CF69959CBBD70D91AD06B18034FB251AEDDD4A5CC91CD0D47C9A4D009FCBC65D5720CA8A6F052236A1CD6C0E2008DE1DF8B04AAF41A0A3925751E70F8C8DD9F3EBCFF51DF2371358838DD58E57B0865917325242738ECF89B3A83057A1E69D68928F074AFDF6EF36C00B90C78B1D3CB2F169BE4F70B8100682485ED43BC128B68D231A15E6D72F4F9878E44B084E26AC97EE5A999946E2AD109D53B3600CD43E246F9604EF53743342F7A632BF4D701E452643539A4B207D675623F9F868581DC50A63"
  },
  "message": ""
}

Event ID 12288 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12289 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12290 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12291 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12293 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12294 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12295 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12296 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12304 — Successfully acquired genuine ticket for template Id {99d92734-d682-4d71-983e-d6ec3f16059f}

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 12304,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:05.418976+00:00",
    "event_record_id": 1570,
    "correlation": {},
    "execution": {
      "process_id": 5592,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "{99d92734-d682-4d71-983e-d6ec3f16059f}"
    ]
  },
  "message": "Successfully acquired genuine ticket for template Id {99d92734-d682-4d71-983e-d6ec3f16059f}"
}

References #

Event ID 12304 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12305 — Genuine state set to genuine for application Id 55c92734-d682-4d71-983e-d6ec3f16059f

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 12305,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:05.415418+00:00",
    "event_record_id": 1569,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "55c92734-d682-4d71-983e-d6ec3f16059f"
    ]
  },
  "message": "Genuine state set to genuine for application Id 55c92734-d682-4d71-983e-d6ec3f16059f"
}

References #

Event ID 12305 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12306 — Rearm successful for AppId = 55c92734-d682-4d71-983e-d6ec3f16059f, SkuId = (null) - 1 Rearms Remaining.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 12306,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-10-25T22:55:35.790597+00:00",
    "event_record_id": 1424,
    "correlation": {},
    "execution": {
      "process_id": 4244,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDevEval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "55c92734-d682-4d71-983e-d6ec3f16059f",
      "(null)",
      "1"
    ]
  },
  "message": "Rearm successful for AppId = 55c92734-d682-4d71-983e-d6ec3f16059f, SkuId = (null) - 1 Rearms Remaining."
}

References #

Event ID 12306 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12307 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12308 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12309 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12310 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12311 — The MSA client has been successfully triggered to update the Device License

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 12311,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:06.265666+00:00",
    "event_record_id": 1571,
    "correlation": {},
    "execution": {
      "process_id": 5592,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The MSA client has been successfully triggered to update the Device License"
}

References #

Event ID 12311 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12320 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 12322 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16384 — Successfully scheduled Software Protection service for re-start at 2024-01-04T22:32:56Z.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 16384,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T23:02:57.838854+00:00",
    "event_record_id": 1612,
    "correlation": {},
    "execution": {
      "process_id": 6932,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "2024-01-04T22:32:56Z",
      "RulesEngine"
    ]
  },
  "message": "Successfully scheduled Software Protection service for re-start at 2024-01-04T22:32:56Z. Reason: RulesEngine."
}

References #

Event ID 16384 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16385 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16386 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16387 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16388 — The current time is 2023-11-05T22:33:07Z : 2023-11-05T22:33:07Z.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Fields #

NameDescription
Data

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 16388,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:07.912565+00:00",
    "event_record_id": 1579,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "2023-11-05T22:33:07Z",
      "2023-11-05T22:33:07Z"
    ]
  },
  "message": "The current time is 2023-11-05T22:33:07Z : 2023-11-05T22:33:07Z."
}

References #

Event ID 16388 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16389 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16390 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16391 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16392 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16393 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16394 — Offline downlevel migration succeeded.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 16394,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T23:02:25.593242+00:00",
    "event_record_id": 1611,
    "correlation": {},
    "execution": {
      "process_id": 6932,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Offline downlevel migration succeeded."
}

References #

Event ID 16394 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16395 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16396 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16397 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 16398 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20481 — Health check initiated.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 20481,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:52.695891+00:00",
    "event_record_id": 1565,
    "correlation": {},
    "execution": {
      "process_id": 7784,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Health check initiated. \n"
}

References #

Event ID 20481 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20482 — Health check passed.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 20482,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:02.718805+00:00",
    "event_record_id": 1566,
    "correlation": {},
    "execution": {
      "process_id": 7784,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Health check passed. \n"
}

References #

Event ID 20482 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20483 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20484 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20485 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20486 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20487 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20488 — Genuine validation data collection started.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 20488,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:32:50.825426+00:00",
    "event_record_id": 1564,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Genuine validation data collection started. \n"
}

References #

Event ID 20488 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20489 — Genuine validation data collection ended.

#
Provider
Microsoft-Windows-Security-SPP
Channel
Application
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-SPP",
    "guid": "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
    "event_source_name": "Software Protection Platform Service",
    "event_id": 20489,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:33:03.750560+00:00",
    "event_record_id": 1568,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Genuine validation data collection ended. \n"
}

References #

Event ID 20489 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20490 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20491 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 20492 —

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Event ID 1073742724 — The Software Protection service is starting.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service is starting.

Message #

The Software Protection service is starting.
Parameters:%1

Fields #

NameDescription
Parameters

Event ID 1073742726 — The Software Protection service has started.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service has started.

Message #

The Software Protection service has started.
%1

Fields #

NameDescription
param1

Event ID 1073742727 — The Software Protection service has stopped.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service has stopped.

Message #

The Software Protection service has stopped.

Event ID 1073742827 — The Software Protection service has completed licensing status check.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service has completed licensing status check.

Message #

The Software Protection service has completed licensing status check.
Application Id=%1
Licensing Status=%2

Fields #

NameDescription
param1
param2

Event ID 1073742828 — The Software Protection service has successfully installed the license.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service has successfully installed the license.

Message #

The Software Protection service has successfully installed the license.
License Title=%1
License Id=%2

Fields #

NameDescription
param1
param2

Event ID 1073742831 — Acquisition of Secure Processor Certificate was successful.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Secure Processor Certificate was successful.

Message #

Acquisition of Secure Processor Certificate was successful.

Event ID 1073742833 — Acquisition of Rights Account Certificate was successful.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Rights Account Certificate was successful.

Message #

Acquisition of Rights Account Certificate was successful.

Event ID 1073742835 — Acquisition of Product Certificate was successful.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Product Certificate was successful.

Message #

Acquisition of Product Certificate was successful.
Sku Id=%1

Fields #

NameDescription
param1

Event ID 1073742837 — Acquisition of End User License was successful.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of End User License was successful.

Message #

Acquisition of End User License was successful.
Sku Id=%1

Fields #

NameDescription
param1

Event ID 1073742840 — Proof of Purchase installed successfully.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Proof of Purchase installed successfully.

Message #

Proof of Purchase installed successfully. 
ACID=%1
PKeyId=%2

Fields #

NameDescription
param1
param2

Event ID 1073742842 — Proof of Purchase removed successfully.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Proof of Purchase removed successfully.

Message #

Proof of Purchase removed successfully. 
ACID=%1
PKeyId=%2

Fields #

NameDescription
param1
param2

Event ID 1073742849 — Grace period has been started.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace period has been started. Grace days=param1 Grace type=param2.

Message #

Grace period has been started. Grace days=%1  Grace type=%2.

Fields #

NameDescription
param1
param2

Event ID 1073742857 — These policies are being excluded since they are only defined with override-only attribute.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

These policies are being excluded since they are only defined with override-only attribute.

Message #

These policies are being excluded since they are only defined with override-only attribute.
Policy Names=%1
App Id=%2
Sku Id=%3

Fields #

NameDescription
param1
param2
param3

Event ID 1073742858 — Duplicate definition of policy found.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Duplicate definition of policy found. Policy name=param1 Priority=param2.

Message #

Duplicate definition of policy found. Policy name=%1  Priority=%2

Fields #

NameDescription
param1
param2

Event ID 1073742859 — A higher priority policy without override-only attribute found.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

A higher priority policy without override-only attribute found. Policy name=param1 Current priority=param2 Previous priority=param3.

Message #

A higher priority policy without override-only attribute found. Policy name=%1  Current priority=%2  Previous priority=%3

Fields #

NameDescription
param1
param2
param3

Event ID 1073742860 — Validity period has been started.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Validity period has been started. Validity minutes=param1 Grace type=param2.

Message #

Validity period has been started. Validity minutes=%1  Grace type=%2.

Fields #

NameDescription
param1
param2

Event ID 1073742864 — Hardware has changed from previous boot.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Hardware has changed from previous boot.

Message #

Hardware has changed from previous boot.
 AppId=%1, SkuId=%2.

Fields #

NameDescription
param1
param2

Event ID 1073742884 — Kernel policy cache has not been updated after Windows Right consumption.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Kernel policy cache has not been updated after Windows Right consumption. This is OK in certain situations.

Message #

Kernel policy cache has not been updated after Windows Right consumption. This is OK in certain situations.

Event ID 1073742885 — Edition changed from param1 to param2 after Windows Right consumption.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Edition changed from param1 to param2 after Windows Right consumption.

Message #

Edition changed from %1 to %2 after Windows Right consumption.

Fields #

NameDescription
param1
param2

Event ID 1073742890 — Initialization status for service objects.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Initialization status for service objects.

Message #

Initialization status for service objects.
%1

Fields #

NameDescription
param1

Event ID 1073742896 — Successfully matched deposited Installation ID with Confirmation ID.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Successfully matched deposited Installation ID with Confirmation ID.

Message #

Successfully matched deposited Installation ID with Confirmation ID.
Sku Id=%1

Fields #

NameDescription
param1

Event ID 1073750030 — Token Store not found.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Token Store not found. Recreating Token Store.

Message #

Token Store not found. Recreating Token Store.

Event ID 1073750048 — Existing scheduler data could not be found.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Existing scheduler data could not be found. The schedule will be re-evaluated.

Message #

Existing scheduler data could not be found.  The schedule will be re-evaluated.

Event ID 1073750049 — The existing scheduler data does not match the expected data.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The existing scheduler data does not match the expected data. The schedule will be re-evaluated.

Message #

The existing scheduler data does not match the expected data.  The schedule will be re-evaluated.
Reason:%1

Fields #

NameDescription
Reason

Event ID 1073750050 — The existing scheduler data is incomplete.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The existing scheduler data is incomplete. The schedule will be re-evaluated.

Message #

The existing scheduler data is incomplete.  The schedule will be re-evaluated.
Reason:%1

Fields #

NameDescription
Reason

Event ID 1073750051 — The existing schedule data is expired.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The existing schedule data is expired. The schedule will be re-evaluated.

Message #

The existing schedule data is expired.  The schedule will be re-evaluated.
Reason:%1

Fields #

NameDescription
Reason

Event ID 1073750052 — The rules engine failed to evaluate the rules.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine failed to evaluate the rules.

Message #

The rules engine failed to evaluate the rules.
Reason:%1
Stage:%2
Additional Data:
%3

Fields #

NameDescription
Reason
Stage
Additional_Data

Event ID 1073750053 — The rules engine failed to perform one or more scheduled actions.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine failed to perform one or more scheduled actions.

Message #

The rules engine failed to perform one or more scheduled actions.
Error Code:%1
Path:%2
Arguments:%3

Fields #

NameDescription
Error_Code
Path
Arguments

Event ID 1073750054 — The rules engine successfully re-evaluated the schedule.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine successfully re-evaluated the schedule.

Message #

The rules engine successfully re-evaluated the schedule.
Kernel policies:
%1

Fields #

NameDescription
Kernel_policies

Event ID 1073750055 — The rules engine gathered the following context data.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine gathered the following context data.

Message #

The rules engine gathered the following context data:
%1

Fields #

NameDescription
The_rules_engine_gathered_the_following_context_data

Event ID 1073750056 — The rules engine failed while trying to update the task triggers with code param1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine failed while trying to update the task triggers with code param1. Reevaluation will occur again soon.

Message #

The rules engine failed while trying to update the task triggers with code %1.  Reevaluation will occur again soon.

Fields #

NameDescription
param1

Event ID 1073750057 — The rules engine reported a failed VL activation attempt.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The rules engine reported a failed VL activation attempt.

Message #

The rules engine reported a failed VL activation attempt.
Reason:%1
AppId = %2, SkuId = %3
Trigger=%4

Fields #

NameDescription
Reason

Event ID 1073754112 — The client has sent an activation request to the key management service machine.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The client has sent an activation request to the key management service machine.

Message #

The client has sent an activation request to the key management service machine.
Info:
%1

Fields #

NameDescription
Info

Event ID 1073754113 — The client has processed an activation response from the key management service machine.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The client has processed an activation response from the key management service machine.

Message #

The client has processed an activation response from the key management service machine.
Info:
%1

Fields #

NameDescription
Info

Event ID 1073754114 — An activation request has been processed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

An activation request has been processed.

Message #

An activation request has been processed.
Info:
%1

Fields #

NameDescription
Info

Event ID 1073754115 — Key Management Service (KMS) failed to start.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Key Management Service (KMS) failed to start.

Message #

Key Management Service (KMS) failed to start.
Info:
%1

Fields #

NameDescription
Info

Event ID 1073754117 — Publishing the Key Management Service (KMS) to DNS in the '%2' domain failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Publishing the Key Management Service (KMS) to DNS in the '%2' domain failed.

Message #

Publishing the Key Management Service (KMS) to DNS in the '%2' domain failed.
Info:
%1

Fields #

NameDescription
Info

Event ID 1073754118 — Publishing the Key Management Service (KMS) to DNS in the 'param1' domain is successful.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Publishing the Key Management Service (KMS) to DNS in the 'param1' domain is successful.

Message #

Publishing the Key Management Service (KMS) to DNS in the '%1' domain is successful.

Fields #

NameDescription
param1

Event ID 1073754119 — Secure KMS initialization failed with code %1 at stage %2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Secure KMS initialization failed with code at stage .

Message #

Secure KMS initialization failed with code %1 at stage %2.

Event ID 1073754120 — Secure KMS initialization succeeded.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Secure KMS initialization succeeded.

Message #

Secure KMS initialization succeeded.

Event ID 1073754128 — Successfully acquired genuine ticket for template Id param1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Successfully acquired genuine ticket for template Id param1.

Message #

Successfully acquired genuine ticket for template Id %1

Fields #

NameDescription
param1

Event ID 1073754129 — Genuine state set to genuine for application Id param1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine state set to genuine for application Id param1.

Message #

Genuine state set to genuine for application Id %1

Fields #

NameDescription
param1

Event ID 1073754130 — Rearm successful for AppId = param1, SkuId = param2 - param3 Rearms Remaining.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Rearm successful for AppId = param1, SkuId = param2 - param3 Rearms Remaining.

Message #

Rearm successful for AppId = %1, SkuId = %2 - %3 Rearms Remaining.

Fields #

NameDescription
param1
param2
param3

Event ID 1073754131 — Skipped Rearm for AppId = param1, SkuId = param2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Skipped Rearm for AppId = param1, SkuId = param2.

Message #

Skipped Rearm for AppId = %1, SkuId = %2.

Fields #

NameDescription
param1
param2

Event ID 1073754132 — Active Directory Activation has succeeded.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Active Directory Activation has succeeded.

Message #

Active Directory Activation has succeeded.
Sku Id = %1
AO name = %2
AO DN = %3

Fields #

NameDescription
param1
param2
param3

Event ID 1073754133 — The client has processed an Automatic VM activation response from the parent partition.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The client has processed an Automatic VM activation response from the parent partition.

Message #

The client has processed an Automatic VM activation response from the parent partition.
Returned hr=%1
%2

Fields #

NameDescription
param1
param2

Event ID 1073754134 — An Automatic VM activation request has been processed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

An Automatic VM activation request has been processed.

Message #

An Automatic VM activation request has been processed.
Returned hr=%1
%2

Fields #

NameDescription
param1
param2

Event ID 1073754135 — The MSA client has been successfully triggered to update the Device License

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The MSA client has been successfully triggered to update the Device License.

Message #

The MSA client has been successfully triggered to update the Device License

Event ID 1073754144 — Token-based Activation has succeeded.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Token-based Activation has succeeded.

Message #

Token-based Activation has succeeded.
Sku Id=%1

Fields #

NameDescription
param1

Event ID 1073758208 — Successfully scheduled Software Protection service for re-start at %1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Successfully scheduled Software Protection service for re-start at . Reason: .

Message #

Successfully scheduled Software Protection service for re-start at %1. Reason: %2.

Event ID 1073758210 — Successfully started task param1\param2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Successfully started task param1\param2.

Message #

Successfully started task %1\%2.

Fields #

NameDescription
param1
param2

Event ID 1073758212 — The current time is 1 : %2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The current time is 1 : %2.

Message #

The current time is %1 : %2.

Fields #

NameDescription
1

Event ID 1073758213 — Grace timer has expired.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace timer has expired. Hr =.

Message #

Grace timer has expired. Hr = %1

Event ID 2147484663 — Detailed HRESULT.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Detailed HRESULT. Returned hr=param1, Original hr=param2.

Message #

Detailed HRESULT. Returned hr=%1, Original hr=%2

Fields #

NameDescription
param1
param2

Event ID 2147484664 — Grace timer notification failed hr=.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace timer notification failed hr=.

Message #

Grace timer notification failed hr=%1

Event ID 2147484665 — Installation of the Proof of Purchase failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Installation of the Proof of Purchase failed. param1.

Message #

Installation of the Proof of Purchase failed. %1
Partial Pkey=%2
ACID=%3
Detailed Error[%4]

Fields #

NameDescription
param1
param2
param3
param4

Event ID 2147484666 — Grace timer creation result %1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace timer creation result .

Message #

Grace timer creation result %1.

Event ID 2147484667 — Removal of the Proof of Purchase failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Removal of the Proof of Purchase failed. param1.

Message #

Removal of the Proof of Purchase failed. %1
ACID=%2
PKeyId=%3

Fields #

NameDescription
param1
param2
param3

Event ID 2147484668 — Proxy Execution Key has failed to load.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Proxy Execution Key has failed to load. param1.

Message #

Proxy Execution Key has failed to load. %1
Proxy Execution Policy=%2

Fields #

NameDescription
param1
param2

Event ID 2147484670 — The system has been tampered.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The system has been tampered. param1.

Message #

The system has been tampered. %1

Fields #

NameDescription
param1

Event ID 2147484672 — The hardware has changed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The hardware has changed.

Message #

The hardware has changed.

Event ID 2147484677 — Unable to get detailed error information during license consumption.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Unable to get detailed error information during license consumption. Last error param1.

Message #

Unable to get detailed error information during license consumption. Last error %1.

Fields #

NameDescription
param1

Event ID 2147484680 — Kernel policy cache update failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Kernel policy cache update failed. param1.

Message #

Kernel policy cache update failed. %1.

Fields #

NameDescription
param1

Event ID 2147484685 — Time-based license remaining param1 time param2 minutes.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Time-based license remaining param1 time param2 minutes.

Message #

Time-based license remaining %1 time %2 minutes.

Fields #

NameDescription
param1
param2

Event ID 2147484692 — The following errors occurred during license evaluation.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The following errors occurred during license evaluation.

Message #

The following errors occurred during license evaluation:
%1

Fields #

NameDescription
The_following_errors_occurred_during_license_evaluation

Event ID 2147484704 — Some data has been reset.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Some data has been reset. param1 [param2].

Message #

Some data has been reset. %1 [%2].

Fields #

NameDescription
param1
param2

Event ID 2147484705 — Unable to update Windows PID information in the registry: Unable_to_update_Windows_PID_information_in_the_registry.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Unable to update Windows PID information in the registry: Unable_to_update_Windows_PID_information_in_the_registry.

Message #

Unable to update Windows PID information in the registry: %1

Fields #

NameDescription
Unable_to_update_Windows_PID_information_in_the_registry

Event ID 2147484706 — Installation of the Proof of Purchase from the ACPI table failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Installation of the Proof of Purchase from the ACPI table failed. Error code.

Message #

Installation of the Proof of Purchase from the ACPI table failed. Error code:
%1

Fields #

NameDescription
ErrorCode

Event ID 2147484707 — Detected OS composition change triggered license re-evaluation.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Detected OS composition change triggered license re-evaluation.

Message #

Detected OS composition change triggered license re-evaluation.

Event ID 2147484708 — Detected OEM product key change triggered license re-evaluation.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Detected OEM product key change triggered license re-evaluation.

Message #

Detected OEM product key change triggered license re-evaluation.

Event ID 2147484715 — Genuine information set for application.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine information set for application. param1, param2, param3.

Message #

Genuine information set for application. %1, %2, %3.

Fields #

NameDescription
param1
param2
param3

Event ID 2147484738 — The Software Licensing edition check failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Licensing edition check failed.

Message #

The Software Licensing edition check failed.
Error code:%1

Fields #

NameDescription
Error_code

Event ID 2147484832 — Invalid chunk hash detected in migration blob.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Invalid chunk hash detected in migration blob.

Message #

Invalid chunk hash detected in migration blob.
Uri: %1

Fields #

NameDescription
Uri

Event ID 2147484833 — Failed to gather PKEY information for SKU.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to gather PKEY information for SKU.

Message #

Failed to gather PKEY information for SKU.
Sku id: %1

Fields #

NameDescription
Sku_id

Event ID 2147484834 — Installing migrated PKEY failed with Sku_id.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Installing migrated PKEY failed with Sku_id.

Message #

Installing migrated PKEY failed with %1.
Sku id: %2

Fields #

NameDescription
Sku_id

Event ID 2147484835 — The Sku associated with the IID/CID is not installed on the local machine.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Sku associated with the IID/CID is not installed on the local machine.

Message #

The Sku associated with the IID/CID is not installed on the local machine.
Sku id: %1

Fields #

NameDescription
Sku_id

Event ID 2147484836 — The Sku associated with the IID/CID does not have a PKEY installed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Sku associated with the IID/CID does not have a PKEY installed.

Message #

The Sku associated with the IID/CID does not have a PKEY installed.
Sku id: %1

Fields #

NameDescription
Sku_id

Event ID 2147484838 — Unable to deposit chunk due to HWID mismatch.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Unable to deposit chunk due to HWID mismatch.

Message #

Unable to deposit chunk due to HWID mismatch.
Uri: %1

Fields #

NameDescription
Uri

Event ID 2147484839 — Unable to deposit chunk due to Trusted Store being recreated.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Unable to deposit chunk due to Trusted Store being recreated.

Message #

Unable to deposit chunk due to Trusted Store being recreated.
Uri: %1

Fields #

NameDescription
Uri

Event ID 2147484840 — Failed to gather PKEY information for backup product key.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to gather PKEY information for backup product key.

Message #

Failed to gather PKEY information for backup product key.
Error: %1
Product key: %2

Fields #

NameDescription
Error
Product_key

Event ID 2147484841 — Failed to gather PKEY information for OEM:DM product key.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to gather PKEY information for OEM:DM product key.

Message #

Failed to gather PKEY information for OEM:DM product key.
Error: %1
Product key: %2

Fields #

NameDescription
Error
Product_key

Event ID 2147484842 — Failed to gather target OS information for PID.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to gather target OS information for PID.

Message #

Failed to gather target OS information for PID.
Error: %1
PID: %2

Fields #

NameDescription
Error
PID

Event ID 2147484843 — Failed to gather target OS information input key data.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to gather target OS information input key data.

Message #

Failed to gather target OS information input key data.
Error: %1

Fields #

NameDescription
Error

Event ID 3221226473 — The Software Protection service failed to start.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

The Software Protection service failed to start. param1.

Message #

The Software Protection service failed to start. %1
%2

Fields #

NameDescription
param1
param2

Event ID 3221226480 — Acquisition of Secure Processor Certificate failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Secure Processor Certificate failed. param1.

Message #

Acquisition of Secure Processor Certificate failed. %1

Fields #

NameDescription
param1

Event ID 3221226482 — Acquisition of Rights Account Certificate failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Rights Account Certificate failed. param1.

Message #

Acquisition of Rights Account Certificate failed. %1

Fields #

NameDescription
param1

Event ID 3221226484 — Acquisition of Product Certificate failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of Product Certificate failed. param1.

Message #

Acquisition of Product Certificate failed. %1
Sku Id=%2

Fields #

NameDescription
param1
param2

Event ID 3221226486 — Acquisition of End User License failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of End User License failed. param1.

Message #

Acquisition of End User License failed. %1
Sku Id=%2

Fields #

NameDescription
param1
param2

Event ID 3221226500 — There are param1 invalid license(s).

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

There are param1 invalid license(s).

Message #

There are %1 invalid license(s).

Fields #

NameDescription
param1

Event ID 3221226513 — Failed to collect hardware data.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to collect hardware data. Error code param1.

Message #

Failed to collect hardware data. Error code %1.

Fields #

NameDescription
param1

Event ID 3221226534 — Deposition of Confirmation ID failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Deposition of Confirmation ID failed. param1.

Message #

Deposition of Confirmation ID failed. %1
Sku Id=%2

Fields #

NameDescription
param1
param2

Event ID 3221226661 — Failed to read migration blob - encryption key not recognized.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to read migration blob - encryption key not recognized.

Message #

Failed to read migration blob - encryption key not recognized.

Event ID 3221233667 — SLSetGenuineInformation in sppcomapi failed with the following error code.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

SLSetGenuineInformation in sppcomapi failed with the following error code.

Message #

SLSetGenuineInformation in sppcomapi failed with the following error code:
%1

Fields #

NameDescription
SLSetGenuineInformation_in_sppcomapi_failed_with_the_following_error_code

Event ID 3221233668 — LoadLibrary call for loading Sppcommdlg.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

LoadLibrary call for loading Sppcommdlg.dll from SLUI.exe failed with error code.

Message #

LoadLibrary call for loading Sppcommdlg.dll from SLUI.exe failed with error code:
%1

Fields #

NameDescription
LoadLibrary_call_for_loading_Sppcommdlgdll_from_SLUIexe_failed_with_error_code

Event ID 3221233669 — SLUI.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

SLUI.exe was launched with the following command-line parameters.

Message #

SLUI.exe was launched with the following command-line parameters:
%1

Fields #

NameDescription
SLUIexe_was_launched_with_the_following_commandline_parameters

Event ID 3221233670 — License Activation.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

License Activation (slui.exe) failed with the following error code.

Message #

License Activation (slui.exe) failed with the following error code:
%1
Command-line arguments:
%2

Fields #

NameDescription
License_Activation_sluiexe_failed_with_the_following_error_code
Commandline_arguments

Event ID 3221233672 — License acquisition failure details.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

License acquisition failure details.

Message #

License acquisition failure details. 
%1

Fields #

NameDescription
param1

Event ID 3221233677 — Token Store found to be corrupt.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Token Store found to be corrupt. Recreating Token Store.

Message #

Token Store found to be corrupt. Recreating Token Store.

Event ID 3221233680 — Acquisition of genuine ticket failed (param1) for template Id param2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Acquisition of genuine ticket failed (param1) for template Id param2.

Message #

Acquisition of genuine ticket failed (%1) for template Id %2

Fields #

NameDescription
param1
param2

Event ID 3221233681 — Genuine state set to non-genuine (param1) for application Id param2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine state set to non-genuine (param1) for application Id param2.

Message #

Genuine state set to non-genuine (%1) for application Id %2

Fields #

NameDescription
param1
param2

Event ID 3221233682 — Update current edition product key id failed with param1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Update current edition product key id failed with param1.

Message #

Update current edition product key id failed with %1

Fields #

NameDescription
param1

Event ID 3221233683 — Update Windows license and product key tokens failed with param1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Update Windows license and product key tokens failed with param1.

Message #

Update Windows license and product key tokens failed with %1. 
%2

Fields #

NameDescription
param1
param2

Event ID 3221233684 — Rearm failed for AppId = %2, SkuId = %3 - %4 Rearms Remaining.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Rearm failed for AppId = , SkuId = - Rearms Remaining. Error Code.

Message #

Rearm failed for AppId = %2, SkuId = %3 - %4 Rearms Remaining.  Error Code: %1

Event ID 3221233685 — Activation Object cannot be retrieved from Active Directory.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Activation Object cannot be retrieved from Active Directory.

Message #

Activation Object cannot be retrieved from Active Directory.
Error Code = %1
Kms Id = %2

Fields #

NameDescription
param1
param2

Event ID 3221233686 — Active Directory Activation Object is not usable.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Active Directory Activation Object is not usable.

Message #

Active Directory Activation Object is not usable.
Error Code = %1
Kms Id = %2
AO Name = %3
AO DN = %4

Fields #

NameDescription
param1
param2
param3
param4

Event ID 3221233687 — Active Directory Activation has failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Active Directory Activation has failed.

Message #

Active Directory Activation has failed.
Error Code = %1
Sku Id = %2

Fields #

NameDescription
param1
param2

Event ID 3221233688 — HCI Marker has failed verification.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

HCI Marker has failed verification. Error Code =.

Message #

HCI Marker has failed verification. Error Code = %1

Event ID 3221233689 — HCI Marker has bad data.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

HCI Marker has bad data. Error Code =.

Message #

HCI Marker has bad data. Error Code = %1

Event ID 3221233690 — Failed ot retrieve HCI Marker.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed ot retrieve HCI Marker . Error Code =.

Message #

Failed ot retrieve HCI Marker . Error Code = %1

Event ID 3221233691 — OEM OA Binding failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

OEM OA Binding failed . Error Code =.

Message #

OEM OA Binding failed . Error Code = %1

Event ID 3221233692 — OEM OA Binding extraction failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

OEM OA Binding extraction failed . Error Code =.

Message #

OEM OA Binding extraction failed . Error Code = %1

Event ID 3221233693 — OEM OA Binding decode failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

OEM OA Binding decode failed . Error Code =.

Message #

OEM OA Binding decode failed . Error Code = %1

Event ID 3221237794 — Failed to deposit Token-based Activation response.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to deposit Token-based Activation response. param1.

Message #

Failed to deposit Token-based Activation response. %1
Sku Id = %2

Fields #

NameDescription
param1
param2

Event ID 3221241857 — Failed to schedule Software Protection service for re-start at %2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to schedule Software Protection service for re-start at . Error Code: .

Message #

Failed to schedule Software Protection service for re-start at %2. Error Code: %1.

Event ID 3221241859 — Failed to run task %2\%3.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Failed to run task \. Error Code: .

Message #

Failed to run task %2\%3. Error Code: %1.

Event ID 3221241860 — Authorized upgrade for PID: AuthorizedUpgradeForPID.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Authorized upgrade for PID: AuthorizedUpgradeForPID.

Message #

Authorized upgrade for PID: %1.

Fields #

NameDescription
AuthorizedUpgradeForPID

Event ID 3221241861 — Downlevel Genuine Ticket successfully deposited.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Downlevel Genuine Ticket successfully deposited.

Message #

Downlevel Genuine Ticket successfully deposited.

Event ID 3221241862 — Updated policy param1 with value of param2 from Clip.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Updated policy param1 with value of param2 from Clip.

Message #

Updated policy %1 with value of %2 from Clip.

Fields #

NameDescription
param1
param2

Event ID 3221241863 — Downlevel Genuine Ticket deposit failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Downlevel Genuine Ticket deposit failed.

Message #

Downlevel Genuine Ticket deposit failed.

Event ID 3221241864 — Downlevel consumption failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Downlevel consumption failed.

Message #

Downlevel consumption failed.

Event ID 3221241865 — Downlevel Migration failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Downlevel Migration failed.

Message #

Downlevel Migration failed.

Event ID 3221241866 — Offline downlevel migration succeeded.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Offline downlevel migration succeeded.

Message #

Offline downlevel migration succeeded.

Event ID 3221241867 — Operation status %2 with return code %1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Operation status with return code .

Message #

Operation status %2 with return code %1.

Event ID 3221241868 — You are on an inactivated device.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

You are on an inactivated device.

Message #

You are on an inactivated device.

Event ID 3221241869 — Device is in grace period for %1 minutes more.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Device is in grace period for minutes more.

Message #

Device is in grace period for %1 minutes more.

Event ID 3221241870 — Error occured during grace period %1 at %2.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Error occured during grace period at .

Message #

Error occured during grace period %1 at %2.

Event ID 3221245953 — Health check initiated.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Health check initiated.

Message #

Health check initiated.

Event ID 3221245954 — Health check passed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Health check passed.

Message #

Health check passed.

Event ID 3221245955 — Tamper detected.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Tamper detected.

Message #

Tamper detected: 
 ScanNeutralFiles = %1, ScanMuiFiles: %2

Event ID 3221245956 — Error occurred during Health check.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Error occurred during Health check.

Message #

Error occurred during Health check: 
 hr = %1

Fields #

NameDescription
param1

Event ID 3221245957 — Genuine validation initiated.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine validation initiated.

Message #

Genuine validation initiated.

Event ID 3221245958 — Genuine validation result.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine validation result.

Message #

Genuine validation result: 
 hr = %1

Fields #

NameDescription
param1

Event ID 3221245959 — Genuine validation failure.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine validation failure.

Message #

Genuine validation failure: 
 hr = %1

Fields #

NameDescription
param1

Event ID 3221245960 — Genuine validation data collection started.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine validation data collection started.

Message #

Genuine validation data collection started.

Event ID 3221245961 — Genuine validation data collection ended.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Genuine validation data collection ended.

Message #

Genuine validation data collection ended.

Event ID 3221245962 — Grace timer initialization failed.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace timer initialization failed.

Message #

Grace timer initialization failed.

Event ID 3221245963 — Grace timer previously created.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace timer previously created.

Message #

Grace timer previously created.

Event ID 3221245964 — Grace period terminated with code %1.

Provider
Microsoft-Windows-Security-SPP
Channel
Operational

Description

Grace period terminated with code .

Message #

Grace period terminated with code %1.