none
Microsoft-Windows-Security-SPP frequent checks.

    General discussion

  • I have just noticed on the Application event logs very frequent checks (some time 10+ checks in the same minute) every two minutes for the last 2 months.

    Is there a reason for the checks?

    extract of the event XML.

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    <System>

    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />

    <EventID Qualifiers="16384">1003</EventID> ...

     

    Friday, August 06, 2010 3:11 PM

All replies

  • Hi Luis,

     

    Have you activated your Windows and Office? Please verify.

     

    Do you encounter any problem when running the system?

     

    Tim Quan

    Tuesday, August 10, 2010 7:32 AM
  • Looks like I just asked the same question, did you ever get an answer?
    Chris Spann, Geek
    Wednesday, August 18, 2010 7:19 PM
  • I'm running Server 2008 R2 Enterprise and my log is full of Security-SPP checks. I don't have office installed and I have activated using my MSDN key. Everything is normal except users are having random problems connecting via mstsc. Sometimes it works, sometimes it doesn't.
    Thursday, October 28, 2010 1:45 PM
  • I'm getting thousands of these Informational messages in my event log in Windows 2008 R2 Standard Core.  Here are the last 3 events which have occured

    Event[0]:
      Log Name: Application
      Source: Microsoft-Windows-Security-SPP
      Date: 2010-12-09T10:48:27.000
      Event ID: 1003
      Task: N/A
      Level: Information
      Opcode: N/A
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: Removed.for.Security
      Description:
    The Software Protection service has completed licensing status check.
    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
    Licensing Status=
    1: f14c8ee3-560d-441e-aee1-325c2e9ae74a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    Event[1]:
      Log Name: Application
      Source: Microsoft-Windows-Security-SPP
      Date: 2010-12-09T10:48:27.000
      Event ID: 1003
      Task: N/A
      Level: Information
      Opcode: N/A
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: Removed.for.Security
      Description:
    The Software Protection service has completed licensing status check.
    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
    Licensing Status=
    1: da71774d-b2c9-4c42-bb7b-a66365d5abb2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    Event[2]:
      Log Name: Application
      Source: Microsoft-Windows-Security-SPP
      Date: 2010-12-09T10:48:27.000
      Event ID: 1003
      Task: N/A
      Level: Information
      Opcode: N/A
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: Removed.for.Security
      Description:
    The Software Protection service has completed licensing status check.
    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
    Licensing Status=
    1: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    Accoding to slmgr.vbs, my license status is currently licensed.

    Microsoft (R) Windows Script Host Version 5.8
    Copyright (C) Microsoft Corporation. All rights reserved.

    Name: Windows Server(R), ServerStandardCore edition
    Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel
    Partial Product Key: Removed
    License Status: Licensed
    Volume activation expiration: 250920 minute(s) (174 day(s))

    Key Management Service client information
        Client Machine ID (CMID): 1f75aebc-ba57-4554-b7a3-b0a8834ec916
        KMS machine name from DNS: removed.for.security:1688
        KMS machine extended PID: 55041-00168-305-246209-03-1033-7600.0000-0522010
        Activation interval: 120 minutes
        Renewal interval: 10080 minutes
        KMS host caching is enabled

    I have just tried doing an activation, which it claims to have been successful

    PS C:\Windows\System32> cscript slmgr.vbs /ato
    Microsoft (R) Windows Script Host Version 5.8
    Copyright (C) Microsoft Corporation. All rights reserved.

    Activating Windows Server(R), ServerStandardCore edition (68531fb9-5511-4989-97be-d11a0f55633f) ...
    Product activated successfully.

    Yet, the events still continue.  They occur every 2 minutes, and there are usually 11 events with different "Licensing Status" every cycle.

    I have the following roles installed

    [X] File Services
        [X] File Server
        [X] Distributed File System
            [X] DFS Namespaces
            [X] DFS Replication
    [X] Print and Document Services
        [X] Print Server
    [X] .NET Framework 3.5.1 Features
        [X] .NET Framework 3.5.1
    [X] Telnet Client
    [X] Windows Server Backup Features
        [X] Windows Server Backup
    [X] WoW64 Support
        [X] WoW64

    There is no other software installed on this server.

    Any idea why this server is generating so many of these events?  There has been 40,421 events in 9 days.

    Thursday, December 09, 2010 10:25 AM
  • Exactly the same, same Application-ID. 

    Mine refers to System32\wucltux.dll which does not appear to exist on my copy of Server Core, and is not mentioned anywhere else in the registry except where it appears in the SoftwareProtectionPlatform key.  wucltux.dll is apparently (part of) the Windows Update Client User Experience functions.  Not sure if that's even available on Server Core?

    Wednesday, December 22, 2010 3:30 PM
  • Same situation here, Windows Server 2008 R2 EE Core. 8 Events EVERY 2 minutes. File Server, running FSRM, Print Managment, PowerShell, .Net 2.0, BPA, thats it. KMS activated.

    1) ---------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: ea36520d-fbfe-4042-acd8-fe926781b615, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    2) ---------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    3) ---------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: c74dc7f6-ea35-4bd7-9776-333ab5dddae6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    4) ---------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: b297426d-464d-4af1-abb2-3474aeecb878, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    5) ----------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: 8fe15d04-fc66-40e6-bf34-942481e06fd8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    6) -----------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    7) -----------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: 620e2b3d-09e7-42fd-802a-17a13652fe7a, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 244800)(?)(?)(?)])(1 )(2 )]

    8) -------------------

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: 4bcc8879-e699-4159-a810-f829566662ca, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

    ----------------------- Every 2 minutes

    Really troubles me that there has been no explanation posted nor clearly a fix required. Either manual or hotfix. It completey takes over the "application" log and the proc never rests (not peg'ed but being used).

     

    Monday, February 14, 2011 4:07 AM
  • My original issue vanished (only did a restart), but now it started again, about 4 to 5 checks per minute.

    Exactly this guy here: wucltux.dll

     

     

     

     

    Tuesday, March 15, 2011 3:29 PM
  • I am getting these too.

    Running Server 2008 R2 core and am getting 2 or 3 a second!!

    The Software Protection service has completed licensing status check.

    Application Id=55c92734-d682-4d71-983e-d6ec3f16059f

    Licensing Status=

    1: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]

     

    So same GUID as all the above

    Tuesday, March 15, 2011 5:21 PM
  • Did anyone find an answer for evet id 1003 Source Security-SPP?  Why it is filling up application logs?
    Raman
    Friday, April 22, 2011 10:25 PM
  • This is happening to me too in Hyper-V Server 2008 R2, and this OS can't be activated freely.

    Cheers,

    Akuma.

    Tuesday, May 10, 2011 8:38 AM
  • Is anyone running server manager remotely? That's what was causing mine. Every time I ran server manager to remotely manage my 3 servers all three systems started logging Secuity-SPP Event ID 1003.

    Rob

    Tuesday, June 14, 2011 1:25 PM