A
Andrew Plaisted
Greetings,
I work in desktop support for a community college. This summer we began changing our activation scheme from MAK to KMS as we cycle out computers. We thought everything went fine until a few weeks ago when some users started reporting their copies of windows were not genuine. The first few reports we thought were a fluke, but it now appears that most of the computers we deployed this summer are affected. When a computer has this issue we are able to reactivate the computer either via the gui or slmgr.vbs /ato without issue. It looks like our KMS server is functioning properly but our clients are not renewing their licenses. Running slmgr.vbs /dlv confirms this showing a Volume activation expiration of 0 minutes. I can verify that the clients have connectivity to the kms server by running slmgr.vbs /ato and receiving a valid license. All of our client computers are Windows 7 Enterprise SP1.
When we initially decided to switch to KMS I set up a pilot group of 25 users. KMS is functioning properly on these computers. A renewal request is sent by these computers every 7 days, a valid response is received from the server, and no issues have been reported in 8 months.
As I looked over the logs on the effected clients I noticed something strange, they are completely devoid of 12288 and 12289 activation request and response events. It seems that the clients are never requesting renewals from the kms server. If I run slmgr.vbs /ato a request is immediately sent and a successful response is immediately received, the license renews, and everything appears to work fine. But when the renewal interval passes a renewal request is never sent and the license is never renewed. Running slmgr.vbs /dlv shows the renewal interval at 10080 minutes. There is activity in the event logs from the Security-SPP service. It is waking up around the renewal time, performing a licensing status check, rescheduling its task for the next interval, and going back to sleep.
The clients both those which work and those which don’t were created from ghost images. They had been sysprepped with /generalize and all have unique CMIDs. Since this issue first became apparent I did an install from disk of a windows 7 client, it functions properly and sends renewal requests to the KMS. I have also built a test from the ghost image used this summer, it activates from the kms but does not send renewal requests.
The following is the output from slmgr.vbs from several computers. We change the activation and renewal intervals to 60 minutes for trouble shooting. I also attached the events generated by Security-SPP. Both from when the renewal time comes up and when slmgr.vbs /ato is run.
Functioning computer from pilot group:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7601.0000-0742011
Installation ID: 011244986693800136570170522132085766058201662535178622
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259200 minute(s) (180 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:01:02 PM
Key Management Service client information
Client Machine ID (CMID): 8708597b-49e8-4957-98e7-9662cdd06bfd
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Functioning computer built from PC:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7601.0000-2912011
Installation ID: 006936798272824896672381555236527746199915851534723813
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259200 minute(s) (180 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:05:39 PM
Key Management Service client information
Client Machine ID (CMID): 672b2348-44b0-41c9-9126-6aaf28392d36
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Non-functioning client:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7600.0000-0522011
Installation ID: 007066005935825266048863484554411700601482254035114306
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259140 minute(s) (179 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:08:43 PM
Key Management Service client information
Client Machine ID (CMID): 5e055c48-535f-4fdc-9695-30f37716da04
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Event logs from non-functioning client:
Information 1/19/2012 2:25:56 PM Security-SPP 1003 None
Information 1/19/2012 2:25:56 PM Security-SPP 902 None
Information 1/19/2012 2:25:56 PM Security-SPP 900 None
Information 1/19/2012 2:25:56 PM Security-SPP 1066 None
Information 1/19/2012 2:30:58 PM Security-SPP 1003 None
Information 1/19/2012 2:35:58 PM Security-SPP 903 None
Information 1/19/2012 2:35:58 PM Security-SPP 16384 None
Details:
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 902
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has started.
6.1.7601.17514
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service is starting.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 1066
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:30:58 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:35:58 PM
Event ID: 903
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has stopped.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:35:58 PM
Event ID: 16384
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Successfully scheduled Software Protection service for re-start at 2012-01-19T20:29:58Z. Reason: GVLK.
Event Log from non-functioning client when slmgr.vbs /ato was sent.
Information 1/19/2012 2:45:26 PM Security-SPP 900 None
Information 1/19/2012 2:45:27 PM Security-SPP 902 None
Information 1/19/2012 2:45:27 PM Security-SPP 1003 None
Information 1/19/2012 2:45:27 PM Security-SPP 1066 None
Information 1/19/2012 2:45:28 PM Security-SPP 12288 None
Information 1/19/2012 2:45:30 PM Security-SPP 1003 None
Information 1/19/2012 2:45:30 PM Security-SPP 1003 None
Information 1/19/2012 2:45:30 PM Security-SPP 12289 None
Information 1/19/2012 2:45:30 PM Security-SPP 1033 None
Information 1/19/2012 2:50:31 PM Security-SPP 903 None
Information 1/19/2012 2:50:31 PM Security-SPP 16384 None
Details:
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:26 PM
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service is starting.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 902
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has started.
6.1.7601.17514
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 1066
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:28 PM
Event ID: 12288
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The client has sent an activation request to the key management service machine.
Info:
0x00000000, 0x00000000, kms.*****.edu:1688, 5e055c48-535f-4fdc-9695-30f37716da04, 2012/01/19 19:45, 0, 1, 259140, ae2ee509-1b34-41c0-acb7-6d4650168915, 25
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 0 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 12289
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The client has processed an activation response from the key management service machine.
Info:
0x00000000, 0x00000000, 1, 0, 50, 60, 60, 2012/01/19 19:45
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1033
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
These policies are being excluded since they are only defined with override-only attribute.
Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Shell-InBoxGames-FreeCell-EnableGame) (Shell-InBoxGames-Hearts-EnableGame) (Shell-InBoxGames-Minesweeper-EnableGame) (Shell-InBoxGames-PurblePlace-EnableGame) (Shell-InBoxGames-Shanghai-EnableGame) (Shell-InBoxGames-Solitaire-EnableGame) (Shell-InBoxGames-SpiderSolitaire-EnableGame) (Shell-MultiplayerInboxGames-Backgammon-EnableGame) (Shell-MultiplayerInboxGames-Checkers-EnableGame) (Shell-MultiplayerInboxGames-Spades-EnableGame) (Shell-PremiumInBoxGames-Chess-EnableGame) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)
App Id=55c92734-d682-4d71-983e-d6ec3f16059f
Sku Id=ae2ee509-1b34-41c0-acb7-6d4650168915
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:50:31 PM
Event ID: 903
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has stopped.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:50:31 PM
Event ID: 16384
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Successfully scheduled Software Protection service for re-start at 2012-01-19T20:44:30Z. Reason: GVLK.
Continue reading...
I work in desktop support for a community college. This summer we began changing our activation scheme from MAK to KMS as we cycle out computers. We thought everything went fine until a few weeks ago when some users started reporting their copies of windows were not genuine. The first few reports we thought were a fluke, but it now appears that most of the computers we deployed this summer are affected. When a computer has this issue we are able to reactivate the computer either via the gui or slmgr.vbs /ato without issue. It looks like our KMS server is functioning properly but our clients are not renewing their licenses. Running slmgr.vbs /dlv confirms this showing a Volume activation expiration of 0 minutes. I can verify that the clients have connectivity to the kms server by running slmgr.vbs /ato and receiving a valid license. All of our client computers are Windows 7 Enterprise SP1.
When we initially decided to switch to KMS I set up a pilot group of 25 users. KMS is functioning properly on these computers. A renewal request is sent by these computers every 7 days, a valid response is received from the server, and no issues have been reported in 8 months.
As I looked over the logs on the effected clients I noticed something strange, they are completely devoid of 12288 and 12289 activation request and response events. It seems that the clients are never requesting renewals from the kms server. If I run slmgr.vbs /ato a request is immediately sent and a successful response is immediately received, the license renews, and everything appears to work fine. But when the renewal interval passes a renewal request is never sent and the license is never renewed. Running slmgr.vbs /dlv shows the renewal interval at 10080 minutes. There is activity in the event logs from the Security-SPP service. It is waking up around the renewal time, performing a licensing status check, rescheduling its task for the next interval, and going back to sleep.
The clients both those which work and those which don’t were created from ghost images. They had been sysprepped with /generalize and all have unique CMIDs. Since this issue first became apparent I did an install from disk of a windows 7 client, it functions properly and sends renewal requests to the KMS. I have also built a test from the ghost image used this summer, it activates from the kms but does not send renewal requests.
The following is the output from slmgr.vbs from several computers. We change the activation and renewal intervals to 60 minutes for trouble shooting. I also attached the events generated by Security-SPP. Both from when the renewal time comes up and when slmgr.vbs /ato is run.
Functioning computer from pilot group:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7601.0000-0742011
Installation ID: 011244986693800136570170522132085766058201662535178622
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259200 minute(s) (180 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:01:02 PM
Key Management Service client information
Client Machine ID (CMID): 8708597b-49e8-4957-98e7-9662cdd06bfd
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Functioning computer built from PC:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7601.0000-2912011
Installation ID: 006936798272824896672381555236527746199915851534723813
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259200 minute(s) (180 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:05:39 PM
Key Management Service client information
Client Machine ID (CMID): 672b2348-44b0-41c9-9126-6aaf28392d36
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Non-functioning client:
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Enterprise edition
Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel
Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00392-00170-918-500000-03-1033-7600.0000-0522011
Installation ID: 007066005935825266048863484554411700601482254035114306
Partial Product Key: HVTHH
License Status: Licensed
Volume activation expiration: 259140 minute(s) (179 day(s))
Remaining Windows rearm count: 1
Trusted time: 1/19/2012 4:08:43 PM
Key Management Service client information
Client Machine ID (CMID): 5e055c48-535f-4fdc-9695-30f37716da04
KMS machine name from DNS: kms.*****.edu:1688
KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012
Activation interval: 60 minutes
Renewal interval: 60 minutes
KMS host caching is enabled
Event logs from non-functioning client:
Information 1/19/2012 2:25:56 PM Security-SPP 1003 None
Information 1/19/2012 2:25:56 PM Security-SPP 902 None
Information 1/19/2012 2:25:56 PM Security-SPP 900 None
Information 1/19/2012 2:25:56 PM Security-SPP 1066 None
Information 1/19/2012 2:30:58 PM Security-SPP 1003 None
Information 1/19/2012 2:35:58 PM Security-SPP 903 None
Information 1/19/2012 2:35:58 PM Security-SPP 16384 None
Details:
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 902
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has started.
6.1.7601.17514
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service is starting.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:25:56 PM
Event ID: 1066
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:30:58 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:35:58 PM
Event ID: 903
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has stopped.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:35:58 PM
Event ID: 16384
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Successfully scheduled Software Protection service for re-start at 2012-01-19T20:29:58Z. Reason: GVLK.
Event Log from non-functioning client when slmgr.vbs /ato was sent.
Information 1/19/2012 2:45:26 PM Security-SPP 900 None
Information 1/19/2012 2:45:27 PM Security-SPP 902 None
Information 1/19/2012 2:45:27 PM Security-SPP 1003 None
Information 1/19/2012 2:45:27 PM Security-SPP 1066 None
Information 1/19/2012 2:45:28 PM Security-SPP 12288 None
Information 1/19/2012 2:45:30 PM Security-SPP 1003 None
Information 1/19/2012 2:45:30 PM Security-SPP 1003 None
Information 1/19/2012 2:45:30 PM Security-SPP 12289 None
Information 1/19/2012 2:45:30 PM Security-SPP 1033 None
Information 1/19/2012 2:50:31 PM Security-SPP 903 None
Information 1/19/2012 2:50:31 PM Security-SPP 16384 None
Details:
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:26 PM
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service is starting.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 902
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has started.
6.1.7601.17514
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:27 PM
Event ID: 1066
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:28 PM
Event ID: 12288
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The client has sent an activation request to the key management service machine.
Info:
0x00000000, 0x00000000, kms.*****.edu:1688, 5e055c48-535f-4fdc-9695-30f37716da04, 2012/01/19 19:45, 0, 1, 259140, ae2ee509-1b34-41c0-acb7-6d4650168915, 25
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 0 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )]
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 12289
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The client has processed an activation response from the key management service machine.
Info:
0x00000000, 0x00000000, 1, 0, 50, 60, 60, 2012/01/19 19:45
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:45:30 PM
Event ID: 1033
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
These policies are being excluded since they are only defined with override-only attribute.
Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Shell-InBoxGames-FreeCell-EnableGame) (Shell-InBoxGames-Hearts-EnableGame) (Shell-InBoxGames-Minesweeper-EnableGame) (Shell-InBoxGames-PurblePlace-EnableGame) (Shell-InBoxGames-Shanghai-EnableGame) (Shell-InBoxGames-Solitaire-EnableGame) (Shell-InBoxGames-SpiderSolitaire-EnableGame) (Shell-MultiplayerInboxGames-Backgammon-EnableGame) (Shell-MultiplayerInboxGames-Checkers-EnableGame) (Shell-MultiplayerInboxGames-Spades-EnableGame) (Shell-PremiumInBoxGames-Chess-EnableGame) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)
App Id=55c92734-d682-4d71-983e-d6ec3f16059f
Sku Id=ae2ee509-1b34-41c0-acb7-6d4650168915
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:50:31 PM
Event ID: 903
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
The Software Protection service has stopped.
Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: 1/19/2012 2:50:31 PM
Event ID: 16384
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: at23563.*****.edu
Description:
Successfully scheduled Software Protection service for re-start at 2012-01-19T20:44:30Z. Reason: GVLK.
Continue reading...