Event Viewer reports multiple errors: ESENT Event ID 490, 455, and Security-SPP Event ID 16385

Dear Maalus.

Please pardon my late reply.

Yes, you can absolutely use the old SATA drive to restore files you need, especially if you're focusing on user data and program/game saves.

Once you install the new NVMe drive and reinstall Windows on it, you can leave the old SATA drive connected to the system. Windows will still be able to access the data on it. You can navigate to your old SATA drive and access your user data, which should include documents, pictures, downloads, etc. Simply copy over the files you need. Program and game saves are usually stored in specific directories (such as C:\Users[YourUsername]\AppData, or in the individual game directories). While the new OS install may not automatically recognize your old application-specific data, you can manually search for and copy over saved game files and configuration data from the old SATA drive to the same locations on your new installation. Many game save files are also in cloud services (e.g., Steam Cloud, OneDrive, etc.), so check for those as well.

Make sure not to try to "restore" or copy over any system or program files from the old SATA drive to the new installation. This can potentially cause issues, as the registry and system settings may not match the new Windows install. Only copy user files (documents, pictures, etc.) and specific data like game saves.

Once you’ve transferred all the important files, you can format the old SATA drive if you wish, or leave it as a secondary drive for extra storage. But yes, your idea of using the old drive for restoring files is perfectly fine and an efficient way to transfer your data without needing a backup.

Let me know if you need any further guidance!

Best Regards,

Martin | Microsoft Community Support Specialist

Dear Maalus,

Thank you for your reply, and no worries about the delay.

Given the circumstances, it's understandable that you need to wait for your new NVMe drive before proceeding with the reinstallation process. The Community Forum automatically closes threads after a period of inactivity. However, rest assured that I can reopen the thread or start a new one if it closes before you've had a chance to complete the suggested steps.

Please provide any updates you can, within a 2-3 week period. This helps keep the thread active and ensures we can continue the conversation without interruption.

Thank you for your patience and understanding. I’ll keep monitoring this space for any updates from you. Feel free to reach out as soon as you have your new drive and are ready to proceed with the reinstallation.

Looking forward to your further feedback and wishing you the best of luck with your new NVMe drive.

Best Regards,

Martin | Microsoft Community Support Specialist

Dear Maalus,

Thank you for your prompt reply!

I appreciate your detailed observations and the context you've provided.

Upon reviewing the situation, I believe we may have been approaching the issue from the wrong angle. Based on what you’ve shared, it seems that the errors you’ve observed in the logs are unlikely to be the root cause of the system lag you’re experiencing. In other words, these logs do not seem to be contributing significantly to the performance issues at hand.

However, I did notice that you mentioned your desire to upgrade your system disk from the previous SATA drive to a new NVMe drive. Additionally, I understand that your current system disk is running low on free space (only 18.5 GB remaining), which can definitely impact overall system performance. With that in mind, I believe upgrading to a higher-performance NVMe drive and reinstalling the operating system could significantly improve the responsiveness and stability of your system.

Here’s what I would recommend:

Replace your current SATA drive with the new NVMe drive. NVMe drives are faster and more efficient, and they’ll provide a noticeable performance boost compared to traditional SATA drives.

Reinstall Windows on the new NVMe drive. A fresh installation will ensure that you’re running the latest system configuration and that your system is optimized for performance.

Post-installation Performance Check: After the reinstallation, if you continue to experience specific performance issues, we can analyze them in detail and take additional steps to optimize your system further.

Here are the general steps to reinstall Windows:

Back up your data to ensure nothing important is lost.

Create an installation media

Go to the official Microsoft Windows 10 download page.

Under the Create Windows 10 Installation Media section, click Download now.

Run the downloaded MediaCreationToolW10.exe.

Read and accept the Microsoft license terms.

Select the language and edition that matches your product key (if necessary, you can use the recommended options for this PC).

Select USB flash drive as the media type and click Next.

Choose your USB drive from the list and click Next. The tool will download Windows 10 and create the installation media.

Wait for the process to complete. This may take some time depending on your internet speed. Once done, you will have a bootable USB drive with Windows 10.

Adjust startup priority

Insert the USB flash drive into the computer where you plan to install Windows 10.

Restart the computer and enter the BIOS/UEFI settings. This is usually done by pressing a key like F2, F10, DEL, or ESC repeatedly during startup (consult your motherboard or laptop manual for the correct key).

In the BIOS/UEFI settings, navigate to the boot menu and set the USB drive as the primary boot device.

Save the changes and exit the BIOS/UEFI settings. The computer will reboot and begin booting from the USB drive.

Install

Select your language, time and currency format, and keyboard layout, then click Next.

Click the Install now button.

Enter your Windows 10 product key. If you don’t have one, you can select I don’t have a product key and activate Windows later.

Choose the edition of Windows 10 that corresponds with your license (usually, this will match what you already installed).

Select Custom: Install Windows only (advanced).

You will see a list of your disk partitions. To perform a clean install, delete all existing partitions on your system drive:

Select each partition, then click Delete, and confirm.

Be very careful to select the correct drive and partitions as this will erase all data on the selected partitions.

Once all partitions are deleted, you should have an unallocated space.

Select the unallocated space and click New. This will create a new partition.

Click Apply and confirm to use the maximum space.

Windows will create several partitions for system files automatically. Select the primary partition (usually the largest one) and click Next.

The installation process will begin, copying and installing Windows 10 files. This will take some time, and your computer may restart several times. （Unplug USB drive）

After installation is complete, Windows 10 will restart and start the initial setup process.

Once Windows is installed, restore your files from the backup and proceed with installing the necessary drivers and software.

I trust this approach will greatly improve your system's performance, but please don’t hesitate to reach out if you run into any challenges or if specific issues persist after the reinstallation.

Looking forward to hearing your feedback and assisting you further!

Best Regards,

Martin | Microsoft Community Support Specialist

Hey, thanks for the reply.

Navigate to the C:\Windows\System32\SRU directory.

Delete all files in the folder (do NOT delete the SRU folder itself).

Restart your computer. This will recreate the SRU files automatically.

I deleted the files in C:\Windows\System32\SRU directory but on restart the files were not recreated.

New errors (Event ID 413 & 488) show up:

• <Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event**">
• <System> <Provider Name="ESENT" /><EventID Qualifiers="0">413</EventID><Version>0</Version><Level>2</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2025-02-05T17:11:25.0524878Z" /><EventRecordID>357276</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>Application</Channel><Computer>DESKTOP-Me</Computer><Security /></System>
• <EventData> <Data>svchost</Data><Data>4928,R,98</Data><Data>SRUJet:</Data><Data>-1032</Data></EventData> </Event>

AND

• <Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event**">
• <System> <Provider Name="ESENT" /><EventID Qualifiers="0">488</EventID><Version>0</Version><Level>2</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2025-02-05T17:11:25.0514592Z" /><EventRecordID>357275</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>Application</Channel><Computer>DESKTOP-Me</Computer><Security /></System>
• <EventData> <Data>svchost</Data><Data>4928,R,98</Data><Data>SRUJet:</Data><Data>C:\WINDOWS\system32\SRU\SRUtmp.log</Data><Data>-1032 (0xfffffbf8)</Data><Data>5 (0x00000005)</Data><Data>Access is denied.</Data></EventData> </Event>

Resolve Security-SPP Event ID 16385

The Software Protection service was running, I restarted it.

Open Command Prompt as Administrator (Win + X > Windows Terminal (Admin) or Command Prompt (Admin)).

Run the following commands one by one:

regsvr32 /u sppsvc.exe

This error shows up when running this first command.

Have not tried the next as you said to run one at a time.

Run System File Checker (SFC) and DISM Tool

I ran these the night I noticed issues and they did not find anything wrong.

(Ps. I have been planning on upgrading my C drive to an nvme with more storage soon. This current drive has been in use since ~2018 and is a 2.5" ssd, 110gb, 18.5gb free).

Let me know if you need any more information!

Dear Maalus,

Welcome to the Microsoft Community

It sounds like you're experiencing issues with ESENT and Security-SPP events which can often indicate problems related to system files, permissions, or services that may need reconfiguration. Let's go through some steps to resolve these errors:

Fix ESENT Event ID 455 and 490 Issues

1. Check Permissions on SRU Folder

Open File Explorer and navigate to C:\Windows\System32\SRU.

Right-click the SRU folder and select Properties.

Go to the Security tab and click Edit.

Ensure the SYSTEM and Administrators groups have Full control.

If permissions are not as required, click Add, type SYSTEM, and grant Full control.

2. Recreate the SRU Database

Note: It's essential to back up the folder before making changes.

Navigate to the C:\Windows\System32\SRU directory.

Delete all files in the folder (do NOT delete the SRU folder itself).

Restart your computer. This will recreate the SRU files automatically.

Resolve Security-SPP Event ID 16385

1. Restart the Software Protection Service

Press Win + R, type services.msc, and press Enter.

Locate Software Protection in the list.

If the service is not running, click Start.

If the service is running, right-click and select Restart.

2. Re-register Software Protection Platform DLLs

Open Command Prompt as Administrator (Win + X > Windows Terminal (Admin) or Command Prompt (Admin)).

Run the following commands one by one:

regsvr32 /u sppsvc.exe

regsvr32 /i sppsvc.exe

Restart your computer.

Run System File Checker (SFC) and DISM Tool

Search for CMD in the start menu, find 'Command Prompt' and select 'Run as administrator'.

Enter the following commands one at a time, making sure to run the next command after the previous one has completed.

DISM /Online /Cleanup-Image /RestoreHealth

SFC /Scannow

After the scan is complete, you can check the scan information to see if any problems were detected and fixed. 

In-place upgrade

Disclaimer:  I always recommend that if you have important data, you should back it up before making large system changes.

• Visit the Windows 10 Download page.
• Under Create Windows 10 installation media, select Download the tool now.
• Launch the Media Creation Tool and choose Create installation media for another PC.
• Select the ISO file and save it locally.
• Once downloaded, right-click on the ISO file and select Mount.
• Run the setup.exe on the mounted drive.
• During setup, choose the option to Keep personal files and apps.
• Follow the on-screen prompts to complete the recovery installation.

Verify Registry Permissions and Integrity

Warning: Be careful when editing the registry. Back up your registry by selecting File > Export in the Registry Editor.

Open Registry Editor (Win + R, type regedit, and press Enter).

Navigate to the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

Right-click on the SoftwareProtectionPlatform key and select Permissions.

Ensure SYSTEM and Administrators have Full Control.

Feel free to reach out if you have any other questions or need further assistance.

Best Regards,

Martin | Microsoft Community Support Specialist