Share via

Keep seeing event ID 16394 and 16384 in event viewer multiple times per hour

Xander Warren 5 Reputation points
2025-12-28T13:26:55.0666667+00:00

Constantly keep getting event ID 16394 followed by 16384 multiple times an hour and I don't know why or how to fix it, cause every source I look up says this is abnormal. Did a sfc scan came back all good same with dism. Also every time this happens in Task scheduler the SoftwareProtectionPath has its SvcRestartTask be updated to trigger everyday when it last does ID 16384 so its constantly changing. Also Software Protection in services is set to run automatically (delayed) and is under the Network Service account. This is a fresh install of windows too as I did a clean install of windows and this was something that was happening with the fresh install, was happening with previous install too. I'm using windows 11 home

These are the events in question

Log Name: Application

Source: Microsoft-Windows-Security-SPP

Date: 2025-12-28 7:48:47 AM

Event ID: 16394

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: DESKTOP-Q2OUQJN

Description:

Offline downlevel migration succeeded.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />

<EventID Qualifiers="49152">16394</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2025-12-28T12:48:47.3342274Z" />

<EventRecordID>1476</EventRecordID>

<Correlation />

<Execution ProcessID="21808" ThreadID="0" />

<Channel>Application</Channel>

<Computer>DESKTOP-Q2OUQJN</Computer>

<Security />

</System>

<EventData>

</EventData>

</Event>

Log Name: Application

Source: Microsoft-Windows-Security-SPP

Date: 2025-12-28 7:49:17 AM

Event ID: 16384

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: DESKTOP-Q2OUQJN

Description:

Successfully scheduled Software Protection service for re-start at 2125-12-04T12:49:17Z. Reason: RulesEngine.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />

<EventID Qualifiers="16384">16384</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2025-12-28T12:49:17.5792675Z" />

<EventRecordID>1477</EventRecordID>

<Correlation />

<Execution ProcessID="21808" ThreadID="0" />

<Channel>Application</Channel>

<Computer>DESKTOP-Q2OUQJN</Computer>

<Security />

</System>

<EventData>

<Data>2125-12-04T12:49:17Z</Data>

<Data>RulesEngine</Data>

</EventData>

</Event>

Windows for home | Windows 11 | Performance and system failures
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Noel Macadangdang 16,810 Reputation points Independent Advisor
    2025-12-28T14:03:16.95+00:00

    Hi,

    Thanks for sharing the details. Seeing those Event IDs 16394 and 16384 pop up repeatedly suggests the Software Protection Platform (SPP) service is going through licensing or activation stuff more than it should.

    I get why it's worrying to see these messages constantly, even after a fresh install. Basically, the SPP service (sppsvc) keeps restarting or scheduling itself when it doesn't need to, which causes those Offline downlevel migration succeeded and Successfully scheduled Software Protection service for re-start messages.

    To fix it, try tweaking the Software Protection service:

    Open Command Prompt as an administrator.

     Run these commands one after the other:

    • net stop sppsvc
    • regsvr32 %windir%\system32\sppwmi.dll
    • net start sppsvc

    Restart your computer and see if the event spam stops.

    If that doesn't do the trick, try refreshing the licensing tokens. Stop the service, rename the tokens.dat file (you'll find it in %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\), restart the service, and then force reactivation with:

    slmgr /ato

    This should safely rebuild the activation tokens. It's a good step to try.

    I hope this helps

    Best Regards

    Noel

    Was this answer helpful?

    1 person found this answer helpful.
  2. Q&A Assist
    2025-12-28T13:27:04.9966667+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The events you are encountering, specifically Event ID 16394 and 16384 from the Microsoft-Windows-Security-SPP source, are related to the Software Protection Platform service. Event ID 16394 indicates that an offline downlevel migration has succeeded, while Event ID 16384 indicates that the Software Protection service has been successfully scheduled for a restart.

    These events can occur frequently if there are issues with the Software Protection service or if the service is being triggered to restart due to certain conditions. Here are a few steps you can take to troubleshoot this issue:

    1. Check Task Scheduler: Ensure that the Software Protection service's scheduled tasks are configured correctly. You may want to verify the settings under Task Scheduler to see if there are any unusual configurations that might cause the service to restart frequently.
    2. Permissions: Make sure that the NETWORK SERVICE account has the necessary permissions on the Software Protection Platform folder. You can check this by navigating to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform and verifying the permissions.
    3. Service Status: Confirm that the Software Protection service is set to run automatically and is under the NETWORK SERVICE account. You can check this in the Services management console.
    4. Windows Updates: Ensure that your Windows 11 installation is up to date, as updates may contain fixes for issues related to the Software Protection service.

    If the issue persists after these checks, it may be beneficial to consult Microsoft support for further assistance, especially since this is a fresh installation of Windows.

    References:

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.