locked
NAP NT events RRS feed

  • Question

  • Does any one have a complete list of NT events that NAP files on the client machine? That is, the list of event IDs and their corresponding meaning. For example, when machine is about to be quarantined, I imagine the NAP agent could be creating an event with an event ID of ???.

     

    Thanks,

    Yi

    Saturday, October 27, 2007 5:56 AM

Answers

  • Hi Yi,

     

    Here are the events. Let me know if you have questions.

     

    Event ID Source Message
    1 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 is installed but not registered with the NAP agent.
    2 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 attempted to initialize, but failed because it has initialized already.
    3 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 attempted to uninitialize but failed because it was not initialized.
    4 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 successfully initialized.
    5 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 successfully uninitialized.
    6 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to initialize but failed because it is not registered with the NAP agent.
    7 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to initialize but failed because it has already initialized.
    8 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to uninitialize but failed because it was not initialized.
    9 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 successfully initialized.
    10 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 successfully uninitialized.
    11 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 failed the call to %2.
    12 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 failed the call to %2.
    13 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to the peripheral component %1. The error code was %2. See the administrator for more information."
    14 Microsoft-Windows-NetworkAccessProtection A Statement of Health with correlation ID %1 could not be created because the maximum size of the connection is too small.
    15 Microsoft-Windows-NetworkAccessProtection A Statement of Health Request with correlation ID %1 could not include the following System Health Agents in the statement of Health: %2
    16 Microsoft-Windows-NetworkAccessProtection A packet has been received with an unexpected correlation of %1 instead of %2.
    17 Microsoft-Windows-NetworkAccessProtection The Statement of Health Response contained configuration for the following SHAs that are not installed on this computer: %1
    18 Microsoft-Windows-NetworkAccessProtection "System Isolation State Change. Previous : State : %1 (%2) Probation Time : %3 Help URL : %4 Current : State : %5 (%6) Probation Time : %7 Help URL : %8"
    19 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server was not available to service the request (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    20 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server denied access to the request (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    21 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The request failed with the error code (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    22 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent successfully acquired a certificate for the request with the correlation-id %2 from %1. The certificate can be identified by its thumbprint of %3"
    23 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent successfully deleted the certificate with the thumbprint of %1. The certificate has expired or the health state of the client has changed or a replacement certificate has been acquired. See the administrator for more information."
    24 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to delete the certificate with the thumbprint of %1. The certificate could not be found or the Network Access Protection Agent has insufficient privileges to delete the certificate (%2). See the administrator for more information."
    25 Microsoft-Windows-NetworkAccessProtection The client loaded NAP group policy.
    26 Microsoft-Windows-NetworkAccessProtection "The NAP service has started. NAP has the following information for this computer: Computer name is %1. Domain status is: %2. The OS SKU is: %4. The service pack version is: %6. The processor type is: %5."
    27 Microsoft-Windows-NetworkAccessProtection "A Statement of Health with correlation ID %1 was received from the System Health Agent %2. The duration to check the client's health was %3 ms."
    28 Microsoft-Windows-NetworkAccessProtection A Statement of Health with correlation ID %1 was sent to the enforcment client %2.
    29 Microsoft-Windows-NetworkAccessProtection "A Statement of Health Response with correlation ID %1 was received from the enforcement client %2. The current client state is %3. The following SHAs report this client non-compliant: %4 The following error categories were encountered: %5 The probation expiration time is: %6 The help URL is: %7 The duration of health check was %8 ms."
    30 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 has returned an error code %2.
    31 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to initialize the following enrollment configuration. HRA Group : %1 CSP Name : %2 Key Specification : %3 Key Length : %4 Signature Algorithm : %5 The intialization failed with the error code (%6). See the HRA administrator for more information."
    32 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server was not available to service the request (%3). See the HRA administrator for more information."
    33 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server denied access to the request (%3). See the HRA administrator for more information."
    34 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The request failed with the error code (%3). See the HRA administrator for more information."
    35 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The server presented a certificate that is not trusted for Enterprise authentication. This server will not be tried again for %4 minutes. Contact the HRA administrator for more information."
    36 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The validation of the server certificate for SSL resulted in an error %3, the certificate is not appropriate for SSL. This server will not be tried again for %4 minutes. Contact the HRA administrator for more information."
    37 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The server presented a certificate that is not trusted for Enterprise authentication. Contact the HRA administrator for more information."
    38 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The validation of the server certificate for SSL resulted in an error %3, the certificate is not appropriate for SSL. Contact the HRA administrator for more information."
    39 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent was unable to determine which HRAs to request a health certificate from. A network change or if GP is configured, a configuration change will prompt further attempts to acquire a health certificate. Otherwise no further attempts will be made. Contact the HRA administrator for more information."
    40 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent has dynamically discovered the following HRAs for this network (using the query %1): %2 The DNS servers in your configuration at the time this discovery took place included: %3"
    41 Microsoft-Windows-NetworkAccessProtection "System Isolation State Change. Extended State details: Previous : Extended State : %1 (%2) Current : Extended State : %3 (%4)"
    42 Microsoft-Windows-NetworkAccessProtection "A Statement of Health Response with correlation ID %1 was just received from the enforcement client %2. The extended state in that Statement of Health Response was %3."
    1000 Microsoft-Windows-SystemHealthAgent The Microsoft Security System Health Agent detected a change in the status of %1
    1001 Microsoft-Windows-SystemHealthAgent The Microsoft Security System Health Agent detected a change in the status of %1
    1002 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent was initialized successfully. Scan Interval: %1 minutes. Time delay before first scan: %2 seconds. Time interval between manual remediation state change: %3 seconds. Manual remediation timeout interval: %4 seconds."
    1003 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent could not be initialized. Failure Code: %1 "
    1004 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent was uninitialized successfully.
    1005 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an online scan.
    1006 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an online scan. Failure Code: %1 "
    1007 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an offline scan.
    1008 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an offline scan. Failure Code: %1 "
    1009 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed a download of security updates.
    1010 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete a download of security updates. Failure Code: %1 "
    1011 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an install of security updates.
    1012 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an install of security updates. Failure Code: %1 "
    1013 Microsoft-Windows-SystemHealthAgent Automatic remediation for firewall succeeded. Windows Firewall was turned on successfully.
    1014 Microsoft-Windows-SystemHealthAgent "Automatic remediation for firewall failed. Windows could not turn on Windows Firewall. Failure Code: %1 "
    1015 Microsoft-Windows-SystemHealthAgent Automatic remediation for Automatic Updates succeeded. Automatic Updates was turned on successfully.
    1016 Microsoft-Windows-SystemHealthAgent "Automatic remediation for Automatic Updates failed. Windows could not turn on Automatic Updates. Failure Code: %1 "
    1017 Microsoft-Windows-SystemHealthAgent Automatic remediation for Windows Security Center service succeeded. Windows Security Center service was turned on successfully.
    1018 Microsoft-Windows-SystemHealthAgent "Automatic remediation for Windows Security Center service failed. Windows could not turn on Windows Security Center service. Failure Code: %1 "
    1019 Microsoft-Windows-SystemHealthAgent Automatic remediation for antispyware succeeded. Windows defender was turned on successfully.
    1020 Microsoft-Windows-SystemHealthAgent "Automatic remediation for antispyware failed. Windows could not turn on Windows Defender. Failure Code: %1 "
    1021 Microsoft-Windows-SystemHealthAgent Automatic remediation for antispyware signatures succeeded. Windows Defender signatures were updated successfully.
    1022 Microsoft-Windows-SystemHealthAgent "Automatic remediation for antispyware signatures failed. Windows could not update signatures for Windows Defender. Failure Code: %1 "
    1023 Microsoft-Windows-SystemHealthAgent The Windows Security Center detected a system health state change. The change in state was also successfully detected by the Windows Security Health Agent.
    1024 Microsoft-Windows-SystemHealthAgent "Windows Security Center detected a system health state change but the Windows Security Health Agent could not enumerate the state change. Failure Code: %1 "
    1025 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent specified a new security health state for the computer. The correlation id for this transaction is %1 "
    1026 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to specify a new security health state for the computer. Failure Code: %1. The correlation id for this transaction is %2 "
    1027 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent notified the Windows Network Access Protection Service of a change in the security health state of the computer.
    1028 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to notify the Windows Network Access Protection Service of a change in the security health state of the computer. Failure Code: %1."
    1029 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent successfully processed a response from the Windows Security Health Validator. The correlation id for this transaction is %1."
    1030 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to process a response from the Windows Security Health Validator. Failure Code: %1. The correlation id for this transaction is %2. "

    Thursday, November 1, 2007 3:05 AM

All replies

  • Hi Yi,

     

    If you can wait for it, troubleshooting information for all the NAP events is scheduled to be published within the next month linked from this site: http://technet2.microsoft.com/windowsserver2008/en/library/49796086-0730-4308-9c5c-503bb7c977621033.mspx.

     

    Do you have questions about a specific event? There are 42 NAP agent events numbered 1 to 42 and 31 system health agent events numbered 1000 to 1030. This would be a long list to post on the forum, and the site I linked will have a lot of detailed information about the events.

     

    -Greg

    Sunday, October 28, 2007 8:23 PM
  • Thanks, Greg.

    In that case, do you mind send the long list to my e-mail address (yizhang79@hotmail.com).

     

    We are developing a custom SHA/SHV pair and the scenario I have in mind is to monitor the final quarantine decision, which may be different from the decision we make in our SHA. For example, our SHA/SHV might think the computer is healthy enough, but the computer might still be quarantined due to failed Windows SHA checks. Knowing the final decision is very helpful in reporting.

     

    While this probably requires only monitoring one quarantine event, we have other needs that might require monitoring other types of NAP client events. So having a complete this would be very helpful.

     

    Yi 

    Monday, October 29, 2007 5:51 AM
  • Hi Yi,

     

    I've forwarded your request to Calvin Choe, who works with our NAP partners on this sort of thing. I believe he can provide the best support.

     

    -Greg

    Monday, October 29, 2007 7:18 AM
  • Hi, Greg,

    Any update on this? I have not received anything from Calvin.

     

    Yi

    Thursday, November 1, 2007 2:26 AM
  • Hi Yi,

     

    Here are the events. Let me know if you have questions.

     

    Event ID Source Message
    1 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 is installed but not registered with the NAP agent.
    2 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 attempted to initialize, but failed because it has initialized already.
    3 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 attempted to uninitialize but failed because it was not initialized.
    4 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 successfully initialized.
    5 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 successfully uninitialized.
    6 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to initialize but failed because it is not registered with the NAP agent.
    7 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to initialize but failed because it has already initialized.
    8 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 attempted to uninitialize but failed because it was not initialized.
    9 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 successfully initialized.
    10 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 successfully uninitialized.
    11 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 failed the call to %2.
    12 Microsoft-Windows-NetworkAccessProtection The enforcement client %1 failed the call to %2.
    13 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to the peripheral component %1. The error code was %2. See the administrator for more information."
    14 Microsoft-Windows-NetworkAccessProtection A Statement of Health with correlation ID %1 could not be created because the maximum size of the connection is too small.
    15 Microsoft-Windows-NetworkAccessProtection A Statement of Health Request with correlation ID %1 could not include the following System Health Agents in the statement of Health: %2
    16 Microsoft-Windows-NetworkAccessProtection A packet has been received with an unexpected correlation of %1 instead of %2.
    17 Microsoft-Windows-NetworkAccessProtection The Statement of Health Response contained configuration for the following SHAs that are not installed on this computer: %1
    18 Microsoft-Windows-NetworkAccessProtection "System Isolation State Change. Previous : State : %1 (%2) Probation Time : %3 Help URL : %4 Current : State : %5 (%6) Probation Time : %7 Help URL : %8"
    19 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server was not available to service the request (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    20 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server denied access to the request (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    21 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The request failed with the error code (%3). This server will not be tried again for %4 minutes. See the HRA administrator for more information."
    22 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent successfully acquired a certificate for the request with the correlation-id %2 from %1. The certificate can be identified by its thumbprint of %3"
    23 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent successfully deleted the certificate with the thumbprint of %1. The certificate has expired or the health state of the client has changed or a replacement certificate has been acquired. See the administrator for more information."
    24 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to delete the certificate with the thumbprint of %1. The certificate could not be found or the Network Access Protection Agent has insufficient privileges to delete the certificate (%2). See the administrator for more information."
    25 Microsoft-Windows-NetworkAccessProtection The client loaded NAP group policy.
    26 Microsoft-Windows-NetworkAccessProtection "The NAP service has started. NAP has the following information for this computer: Computer name is %1. Domain status is: %2. The OS SKU is: %4. The service pack version is: %6. The processor type is: %5."
    27 Microsoft-Windows-NetworkAccessProtection "A Statement of Health with correlation ID %1 was received from the System Health Agent %2. The duration to check the client's health was %3 ms."
    28 Microsoft-Windows-NetworkAccessProtection A Statement of Health with correlation ID %1 was sent to the enforcment client %2.
    29 Microsoft-Windows-NetworkAccessProtection "A Statement of Health Response with correlation ID %1 was received from the enforcement client %2. The current client state is %3. The following SHAs report this client non-compliant: %4 The following error categories were encountered: %5 The probation expiration time is: %6 The help URL is: %7 The duration of health check was %8 ms."
    30 Microsoft-Windows-NetworkAccessProtection The System Health Agent %1 has returned an error code %2.
    31 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to initialize the following enrollment configuration. HRA Group : %1 CSP Name : %2 Key Specification : %3 Key Length : %4 Signature Algorithm : %5 The intialization failed with the error code (%6). See the HRA administrator for more information."
    32 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server was not available to service the request (%3). See the HRA administrator for more information."
    33 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The server denied access to the request (%3). See the HRA administrator for more information."
    34 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent failed to acquire a certificate for the request with the correlation-id %2 from %1. The request failed with the error code (%3). See the HRA administrator for more information."
    35 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The server presented a certificate that is not trusted for Enterprise authentication. This server will not be tried again for %4 minutes. Contact the HRA administrator for more information."
    36 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The validation of the server certificate for SSL resulted in an error %3, the certificate is not appropriate for SSL. This server will not be tried again for %4 minutes. Contact the HRA administrator for more information."
    37 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The server presented a certificate that is not trusted for Enterprise authentication. Contact the HRA administrator for more information."
    38 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection agent failed to get a certificate for the request with correlation-id %2 from %1. The validation of the server certificate for SSL resulted in an error %3, the certificate is not appropriate for SSL. Contact the HRA administrator for more information."
    39 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent was unable to determine which HRAs to request a health certificate from. A network change or if GP is configured, a configuration change will prompt further attempts to acquire a health certificate. Otherwise no further attempts will be made. Contact the HRA administrator for more information."
    40 Microsoft-Windows-NetworkAccessProtection "The Network Access Protection Agent has dynamically discovered the following HRAs for this network (using the query %1): %2 The DNS servers in your configuration at the time this discovery took place included: %3"
    41 Microsoft-Windows-NetworkAccessProtection "System Isolation State Change. Extended State details: Previous : Extended State : %1 (%2) Current : Extended State : %3 (%4)"
    42 Microsoft-Windows-NetworkAccessProtection "A Statement of Health Response with correlation ID %1 was just received from the enforcement client %2. The extended state in that Statement of Health Response was %3."
    1000 Microsoft-Windows-SystemHealthAgent The Microsoft Security System Health Agent detected a change in the status of %1
    1001 Microsoft-Windows-SystemHealthAgent The Microsoft Security System Health Agent detected a change in the status of %1
    1002 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent was initialized successfully. Scan Interval: %1 minutes. Time delay before first scan: %2 seconds. Time interval between manual remediation state change: %3 seconds. Manual remediation timeout interval: %4 seconds."
    1003 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent could not be initialized. Failure Code: %1 "
    1004 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent was uninitialized successfully.
    1005 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an online scan.
    1006 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an online scan. Failure Code: %1 "
    1007 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an offline scan.
    1008 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an offline scan. Failure Code: %1 "
    1009 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed a download of security updates.
    1010 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete a download of security updates. Failure Code: %1 "
    1011 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent completed an install of security updates.
    1012 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to complete an install of security updates. Failure Code: %1 "
    1013 Microsoft-Windows-SystemHealthAgent Automatic remediation for firewall succeeded. Windows Firewall was turned on successfully.
    1014 Microsoft-Windows-SystemHealthAgent "Automatic remediation for firewall failed. Windows could not turn on Windows Firewall. Failure Code: %1 "
    1015 Microsoft-Windows-SystemHealthAgent Automatic remediation for Automatic Updates succeeded. Automatic Updates was turned on successfully.
    1016 Microsoft-Windows-SystemHealthAgent "Automatic remediation for Automatic Updates failed. Windows could not turn on Automatic Updates. Failure Code: %1 "
    1017 Microsoft-Windows-SystemHealthAgent Automatic remediation for Windows Security Center service succeeded. Windows Security Center service was turned on successfully.
    1018 Microsoft-Windows-SystemHealthAgent "Automatic remediation for Windows Security Center service failed. Windows could not turn on Windows Security Center service. Failure Code: %1 "
    1019 Microsoft-Windows-SystemHealthAgent Automatic remediation for antispyware succeeded. Windows defender was turned on successfully.
    1020 Microsoft-Windows-SystemHealthAgent "Automatic remediation for antispyware failed. Windows could not turn on Windows Defender. Failure Code: %1 "
    1021 Microsoft-Windows-SystemHealthAgent Automatic remediation for antispyware signatures succeeded. Windows Defender signatures were updated successfully.
    1022 Microsoft-Windows-SystemHealthAgent "Automatic remediation for antispyware signatures failed. Windows could not update signatures for Windows Defender. Failure Code: %1 "
    1023 Microsoft-Windows-SystemHealthAgent The Windows Security Center detected a system health state change. The change in state was also successfully detected by the Windows Security Health Agent.
    1024 Microsoft-Windows-SystemHealthAgent "Windows Security Center detected a system health state change but the Windows Security Health Agent could not enumerate the state change. Failure Code: %1 "
    1025 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent specified a new security health state for the computer. The correlation id for this transaction is %1 "
    1026 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to specify a new security health state for the computer. Failure Code: %1. The correlation id for this transaction is %2 "
    1027 Microsoft-Windows-SystemHealthAgent The Windows Security Health Agent notified the Windows Network Access Protection Service of a change in the security health state of the computer.
    1028 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to notify the Windows Network Access Protection Service of a change in the security health state of the computer. Failure Code: %1."
    1029 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent successfully processed a response from the Windows Security Health Validator. The correlation id for this transaction is %1."
    1030 Microsoft-Windows-SystemHealthAgent "The Windows Security Health Agent failed to process a response from the Windows Security Health Validator. Failure Code: %1. The correlation id for this transaction is %2. "

    Thursday, November 1, 2007 3:05 AM