Share via

Security-SPP event ID 16384/16394

Anonymous
2025-02-06T00:10:43+00:00

Since updating to 24h2 on Dec 6 ive noticed my event log is constantly spammed all day long by the following two events:

16384: Successfully scheduled Software Protection service for re-start at 2125-01-12T22:38:50Z. Reason: RulesEngine.

16394: Offline downlevel migration succeeded.

I have run all the usual windows file checkers etc and saw online to make sure network service has read permission to software protection program which it does. Windows is uptodate (26.100.2894).

Please advise. While i dont belive its causing any degradation in performance i dont believe this should be happening.

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

10 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Francisco Montilla 30,255 Reputation points Independent Advisor
    2025-02-06T04:41:53+00:00

    Hi Josh,

    I'm an Independent Advisor and I'm happy to help you.

    The Security-SPP event IDs 16384 and 16394 are related to the Software Protection Platform (SPP), which handles Windows licensing and activation. Seeing them repeatedly in the Event Viewer suggests that the Software Protection service (sppsvc) is unnecessarily restarting or re-triggering.

    You can try to restart and Reconfigure the Software Protection Service:

    • Open Command Prompt as Administrator.
    • Run the following commands one at a time:

    net stop sppsvc

    regsvr32 %windir%\system32\sppwmi.dll

    net start sppsvc

    • Restart your computer and check if the event log spam has stopped.

    Let me know if the issue persists, and we can try another approach! :)

    2 people found this answer helpful.
    0 comments
  2. Francisco Montilla 30,255 Reputation points Independent Advisor
    2025-02-09T11:54:45+00:00

    It's possible that an update modified something that could be causing these, but It shouldn't be a worry at all. Since none of this worked, I suggest reporting this issue to Microsoft via the "Feedback Hub" app.

    I'm sorry that I didn't find a more effective solution, thank you for your patience!!

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2025-02-09T10:33:45+00:00

    No change, only sub folders in the MS folder are Internet Explorer, Spelling, System Certificates and Windows.

    1 person found this answer helpful.
    0 comments
  4. Francisco Montilla 30,255 Reputation points Independent Advisor
    2025-02-08T01:09:41+00:00

    Hi Josh,

    I'm sorry for the late reply, I'm in a different timezone but I'm back now to help you.

    The token refresh method is a standard and safe troubleshooting step for SPP issues. Renaming the tokens.dat file forces the Software Protection Platform to rebuild its activation tokens, and there’s no known risk of permanently affecting your activation if you follow the procedure correctly.

    However, if you’re concerned about any risk, it’s best practice to create a backup of the tokens.dat file before proceeding. This way, you can restore it if needed.

    1 person found this answer helpful.
    0 comments
  5. Anonymous
    2025-02-06T10:05:22+00:00

    No change stopping/starting the service, after a few minutes it continues to spam the event logs.

    regsvr32 %windir%\system32\sppwmi.dll gave me the following error (as administrator):

    ![](https://learn-attachment.microsoft.com/api/attachments/653fe10e-c4e1-4daf-a132-a38e5b1ea2d5?platform=QnA