Windows 10: Security SPP and Time-Service events

Hello,

I have noticed today those inforamtion in the event logs that concerns me :

Event 16394, Security SPP - migration on the lower level in offline mode was preformed successfully
Event 16384, Security SPP - scheduled a restart of application protection service at 2120-07-05T16:36:02Z Reason : Rules Engine

They occured yesterday while i was away from my switched on computer. I notice those events today as well though.
I also noticed that while being away Time-Service did the following :

158 - The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well.

37 - The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 ntp.m0x90.0.0.0:123->40.81.94.65:123.

Could the above events be resposnbile for switching off my Zone Alarm firewallnoticed by WINDOWS 10 and for fiding a new Networkbut with the same details by Avast Antivir?


Thanks for answer in advance


Edit : Can i kindly ask anyone in this forum to tell me if those events could be related or am i just starting to get paranoid?

At the very least - could you just shortly explain me to what those Security SPP events relate to?

:)

 

Security SPP and Time-Service events

Hello,

I have noticed today those inforamtion in the event logs that concerns me :

Event 16394, Security SPP - migration on the lower level in offline mode was preformed successfully

Event 16384, Security SPP - scheduled a restart of application protection service at 2120-07-05T16:36:02Z Reason : Rules Engine

They occured yesterday while i was away from my switched on computer. I notice those events today as well though.

I also noticed that while being away Time-Service did the following :

158 - The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior
for the current provider in the current operating environment as well.

37 - The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123).

Could the above events be resposnbile for switching off my Zone Alarm firewall(noticed by WINDOWS 10) and for fiding a new Network(but with the same details) by Avast Antivir?

Thanks for answer in advance

 

Error Security-SPP in Windows Server 2016 (Event ID: 16385)

Hello,

I am running Windows Server 2016

The error is showing up every 30 seconds and I can't Remove This Event

When I go to Event Properties for the Security-SPP error I'm getting the following information is presented:

"Failed to schedule Software Protection service for re-start at 2118-05-13T04:05:27Z. Error Code: 0x80070002."

Source: Security-SPP

Event ID: 16385

Level: Error

User: N/A

OpCode: Info

Task Category: None

Keywords: Classic

I hope someone can help me to stop and remove this event now.

Regards,

MooLectro

 

Information 13/03/2018 08:19:22 Security-SPP 16384 None and 16385

• 1 What task are you trying to perform that you’ve encountered this issue?
• 2 What troubleshooting steps have you done so far?
• 3 Did you make any changes to the computer prior to this issue?

1 Run Windows

13-Mar-2018 23:23 running BBC iplayer

2 Win Pro was "clean installed" 01-Mar-2018

3 Now running 1709 16299.309 as of 13-mar-2018 22:00

Win 10 home & pro

1709

16299.309 after updates from 16299.248

# # #

# # #

#

Information 13/03/2018 21:57:59 Security-SPP 902 None

#

The Software Protection service has started.

10.0.16299.248

#

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

<Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />

<EventID Qualifiers="16384">902</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2018-03-13T21:57:59.304124200Z" />

<EventRecordID>4626</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>xxxxx</Computer>

<Security />

</System>

- <EventData>

<Data>10.0.16299.248</Data>

</EventData>

</Event>

#

- <EventData>

<Data>10.0.16299.248</Data>

This is showing the wrong version number it should be 10.0.16299.309 should it not?

#

Win 10 Home

16299.309

Information 13/03/2018 21:58:29 Security-SPP 16384 None

Successfully scheduled Software Protection service for re-start at 2118-02-17T21:58:29Z. Reason: RulesEngine.

Information 13/03/2018 21:58:29 Security-SPP 903 None

The Software Protection service has stopped.

no sign of restart at 22:27:00

#

Win 10 Pro

13-mar-2018 21:59:56 16384 Security SPP

... software Protection service for restart 2118-02017T21:59:56Z -- 100 years time

13-mar-2018 22:04:44 916 ESENT

22:21:00 Software Protection still stopped ...

#

16384 happens during re-starts followed by 903 Win 10 Pro

#