Event ID 16385 SoftwareProtectionPlatform Rebuild

Question

Event ID 16385 SoftwareProtectionPlatform Rebuild

West 80

Spent hours attempting to add NETWORK SERVICES to folders between Root drive and sppsvc folders. However, nothing seems to work. I then find NETWORK SERVICE may not apply, since this is being phased out. Can someone confirm if SID is the path forward? Also if this is the case which is the recommended path to rebuild these files?

Windows 11 25H2 Build 26200.7922

Thanks

West 80 Reputation points

2026-03-03T16:40:08.6066667+00:00

The response below does not fully address Event ID 16385. I had to spend hours and only with help from Copilot and Gemini was I able to fix the issue.

"While rebuilding the tokens.dat file is a standard step for activation issues, it does not address the underlying Event ID 16385 error if the problem is a corrupted SoftwareProtectionPlatform task within the Task Scheduler.

In my case, the 'easy' token rebuild was not the solution. The actual fix required addressing the Task Scheduler directly:

Identify the Corruption: The SPP tasks in the Task Scheduler were either missing, corrupted, or pointing to incorrect security descriptors

The Manual Fix:

Navigated to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform.

Backed up and then removed the corrupted task files.

Re-imported clean versions of the tasks (SvcRestartTask, etc.) from a healthy system or forced a system regeneration.

Permission Audit: Ensured the NETWORK SERVICE account had explicit 'Read' permissions on the SoftwareProtectionPlatform folder, as lack of these permissions is a primary trigger for 16385.

Verification: The error only stopped once the SvcRestartTask successfully ran and SvcRestartTask successfully ran and showed a 'Ready' status, rather than just resetting the activation tokens.
West 80 Reputation points

2026-03-03T16:49:43.21+00:00

Microsoft Windows team really needs to come up with a more comprehensive checklist for troubleshooting this error.

1 answer

Your answer

West 80 Reputation points

2026-03-03T16:40:08.6066667+00:00

The response below does not fully address Event ID 16385. I had to spend hours and only with help from Copilot and Gemini was I able to fix the issue.

"While rebuilding the tokens.dat file is a standard step for activation issues, it does not address the underlying Event ID 16385 error if the problem is a corrupted SoftwareProtectionPlatform task within the Task Scheduler.

In my case, the 'easy' token rebuild was not the solution. The actual fix required addressing the Task Scheduler directly:

Identify the Corruption: The SPP tasks in the Task Scheduler were either missing, corrupted, or pointing to incorrect security descriptors

The Manual Fix:

Navigated to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform.

Backed up and then removed the corrupted task files.

Re-imported clean versions of the tasks (SvcRestartTask, etc.) from a healthy system or forced a system regeneration.

Permission Audit: Ensured the NETWORK SERVICE account had explicit 'Read' permissions on the SoftwareProtectionPlatform folder, as lack of these permissions is a primary trigger for 16385.

Verification: The error only stopped once the SvcRestartTask successfully ran and SvcRestartTask successfully ran and showed a 'Ready' status, rather than just resetting the activation tokens.
West 80 Reputation points

2026-03-03T16:49:43.21+00:00

Microsoft Windows team really needs to come up with a more comprehensive checklist for troubleshooting this error.

Answer 1

For Event ID 16385 from SoftwareProtectionPlatform on Windows 11, the issue is with Windows activation/licensing, not with SIDs. The path forward is to fix Software Protection Platform, typically by rebuilding the Tokens.dat file. SIDs are unrelated here.

On modern Windows (including Windows 10, Windows Server 2016 and later), the supported way to rebuild the activation store is:

Open an elevated Command Prompt (Run as administrator).

Run these commands in order:

   net stop sppsvc
   cd %Systemdrive%\Windows\System32\spp\store\2.0\
   ren tokens.dat tokens.bar
   net start sppsvc
   cscript.exe %windir%\system32\slmgr.vbs /rilc

Restart the computer.

This sequence stops the Software Protection Platform service, renames the existing Tokens.dat, restarts the service, and reloads the licensing configuration, causing Windows to recreate Tokens.dat.

If the error is instead the “Failed to schedule Software Protection service for restart” type, verify the following for the SoftwareProtectionPlatform scheduled task and folder:

Task Scheduler service is running.
The Software Protection Platform scheduled task is configured to run under the NETWORK SERVICE account.
The NETWORK SERVICE account has Read permissions on: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform
Restart the Software Protection service after correcting the above.

NETWORK SERVICE is still used by Software Protection Platform in these scenarios; it is not replaced by a SID-based configuration. SIDs do not replace the need to grant the correct account (NETWORK SERVICE) permissions on the task folder.

References:

Share via

Event ID 16385 SoftwareProtectionPlatform Rebuild

1 answer

Your answer