Microsoft-Windows-BitLocker-Driver

Event	Title	Channel	Sample	Rule
24577	Encryption of volume Volume started.	System	N	N
24578	Encryption of volume Volume stopped.	System	N	N
24579	Encryption of volume Volume completed.	System	N	N
24580	Decryption of volume Volume started.	System	N	N
24581	Decryption of volume Volume stopped.	System	N	N
24582	Decryption of volume Volume completed.	System	N	N
24583	Conversion worker thread for volume Volume was started.	System	N	N
24584	Conversion worker thread for volume Volume was temporarily stopped.	System	N	N
24585	Auto-unlock enabled for volume Volume.	System	N	N
24586	An error was encountered converting volume Volume.	System	N	N
24587	Auto-unlock disabled for volume Volume.	System	N	N
24588	The conversion operation on volume Volume encountered a bad sector error.	System	N	N
24589	Failed to enable auto-unlock for volume Volume.	System	N	N
24590	Failed to disable auto-unlock for volume Volume.	System	N	N
24591	Auto-unlocking failed for volume Volume.	System	N	N
24592	An attempt to automatically restart conversion on volume Volume failed.	System	N	N
24593	Metadata write: Volume Volume returning errors while trying to modify metadata.	System	N	N
24594	Metadata rebuild: An attempt to write a copy of metadata on volume Volume failed …	System	N	N
24595	Volume Volume contains bad clusters.	System	N	N
24596	No key file was found for Volume Volume during restart.	System	N	N
24597	A corrupt key file was encountered for Volume Volume during restart.	System	N	N
24598	No volume master key was retrieved in a key file during restart.	System	N	N
24599	The TPM was not enabled during restart.	System	N	N
24600	The SRK was found to be invalid during restart.	System	N	N
24601	The PCRs did not match during restart.	System	N	N
24602	No volume master key was retrieved from a key file during restart.	System	N	N
24603	A boot application hash did not match expected value during restart.	System	N	N
24604	The boot configuration options did not match expected values during restart.	System	N	N
24605	No volume master key was retrieved from a PIN during restart.	System	N	N
24606	No volume master key was retrieved from a recovery password during restart.	System	N	N
24607	A valid key was found during the last restart.	System	N	N
24608	An unexpected error was encountered attempting to retrieve the volume master key …	System	N	N
24609	A key was not available from required sources during restart.	System	N	N
24610	Metadata commit: Not all copies of metadata on volume Volume could be written.	System	N	N
24611	Metadata commit: No copies of metadata on volume Volume could be written.	System	N	N
24612	Metadata commit: Metadata update could not be flushed.	System	N	N
24613	Metadata commit: An attempt to verify metadata update on volume Volume failed at …	System	N	N
24614	Metadata commit: Update verification of metadata on volume Volume failed.	System	N	N
24615	Metadata initial read: Primary metadata record on volume Volume could not be …	System	N	N
24616	Metadata initial read: Failover metadata record on volume Volume could not be …	System	N	N
24617	Metadata initial read: Failover metadata record on volume Volume used.	System	N	N
24618	Metadata check: Metadata record on volume Volume could not be read and has been …	System	N	N
24619	Metadata rebuild: An attempt build a new set of metadata on Volume failed at …	System	N	N
24620	Encrypted volume check: Volume information on Volume cannot be read.	System	N	N
24621	Initial state check: Rolling volume conversion transaction on Volume.	System	N	N
24622	BIOS/TCG Memory Overwrite Control: Error finding TPM driver.	System	N	N
24623	BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.	System	N	N
24624	BIOS/TCG Memory Overwrite Control: Error changing value.	System	N	N
24625	A valid BitLocker key was found during the last restart.	System	N	N
24626	The auto-unlock master key was not available from the operating system volume.	System	N	N
24627	Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.	System	N	N
24628	The partition size specified in the partition table is smaller than the size of …	System	N	N
24629	The system firmware failed to enable overwriting of system memory on restart.	System	N	N
24630	Bootmgr failed to find a BitLocker key file for Volume Volume.	System	N	N
24631	Bootmgr detected corruption in the BitLocker key file for Volume Volume.	System	N	N
24632	Bootmgr failed to obtain the BitLocker volume master key from the key file …	System	N	N
24633	Bootmgr determined that the TPM is disabled.	System	N	N
24634	Bootmgr determined that the authorization data for the SRK of the TPM is …	System	N	N
24635	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System	N	N
24636	Bootmgr failed to obtain the BitLocker volume master key from the TPM.	System	N	N
24637	A boot application hash did not match the expected value during restart.	System	N	N
24638	Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.	System	N	N
24639	Bootmgr failed to obtain the BitLocker volume master key from the recovery …	System	N	N
24640	A valid BitLocker key was found during the last restart.	System	N	N
24641	An unexpected error was encountered attempting to retrieve the BitLocker volume …	System	N	N
24642	An internal BitLocker self-test failed for drive Volume.	System	N	N
24643	Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced …	System	N	N
24644	An internal BitLocker self-test failed for drive Volume when switching from raw …	System	N	N
24645	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24646	Encryption of the used space on volume Volume started.	System	N	N
24647	Encryption of the used space on volume Volume stopped.	System	N	N
24648	Encryption of the used space on volume Volume completed.	System	N	N
24649	Wiping of free space on volume Volume started.	System	N	N
24650	Wiping of free space on volume Volume stopped.	System	N	N
24651	Wiping of free space on volume Volume completed.	System	N	N
24652	A recovery password was used to start Windows.	System	N	N
24653	Bootmgr failed to obtain the BitLocker volume master key from the password.	System	N	N
24654	A recovery key was used to start Windows.	System	N	N
24655	The BitLocker driver has started a self-healing operation on the metadata of …	System	N	N
24656	The BitLocker driver has successfully completed a self-healing operation on the …	System	N	N
24657	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System	N	N
24658	Bootmgr failed to obtain the BitLocker volume master key from the TPM because …	System	N	N
24659	Device Lock was triggered due to too many incorrect password attempts.	System	N	N
24660	BitLocker encryption on write started for volume Volume.	System	N	N
24661	BitLocker free space sweep started for volume Volume.	System	N	N
24662	BitLocker free space sweep stopped for volume Volume.	System	N	N
24663	BitLocker free space sweep completed for volume Volume.	System	N	N
24664	BitLocker finalization sweep started for volume Volume.	System	N	N
24665	BitLocker finalization sweep paused for volume Volume.	System	N	N
24666	BitLocker finalization sweep resumed for volume Volume.	System	N	N
24667	BitLocker finalization sweep completed for volume Volume.	System	N	N
24668	BitLocker encryption on write failed for volume Volume due to disk I/O error.	System	N	N
24669	BitLocker finalization sweep failed for volume Volume due to disk I/O error.	System	N	N
24670	Disk containing volume Volume is employing non-volatile caching software which …	System	N	N
24671	Disk containing volume Volume is employing non-volatile caching software which …	System	N	N
24672	Device Lock was triggered due to Device Lockout state validation failure.	System	N	N
24673	Drive Volume is no longer automatically managed by device encryption.	System	N	N
24674	Drive Volume is now automatically managed by device encryption.	System	N	N
24675	WIM hash generation paused for volume Volume.	System	N	N
24676	WIM hash generation resumed for volume Volume.	System	N	N
24677	WIM hash generation completed for volume Volume.	System	N	N
24678	WIM hash generation failed for volume Volume.	System	N	N
24679	WIM hashes will be deleted for volume Volume.	System	N	N
24680	Bootmgr failed to unseal VMK using the TPM	System	N	N
24681	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24682	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24683	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24684	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24685	Bootmgr failed to obtain the BitLocker volume master key from the network key …	System	N	N
24686	Bootmgr failed to obtain the BitLocker volume master key from the network boot …	System	N	N
24687	BitLocker timed out attempting to enumerate bands during volume discovery on …	System	N	N
24688	Failed to read metadata from logical copy.	System	N	N
24689	Attempted to read metadata from logical copy.	System	N	N
24690	Attempted to fix metadata logical copies.	System	N	N
24691	Failed to verify metadata logical copy against Primary.	System	N	N
24692	Failed to verify metadata file against Primary copy.	System	N	N
24693	Failed to register metadata check worker.	System	N	N
24694	Metadata check worker started.	System	N	N
24695	Metadata check worker completed.	System	N	N
24696	Successfully created metadata file.	System	N	N
24697	Failed to read a valid metadata copy.	System	N	N
24698	Failed to fix metadata logical copy.	System	N	N
24699	Attempted to check metadata logical copies.	System	N	N
24700	Successfully fixed metadata logical copy.	System	N	N
24701	Volume Volume has been excluded from device encryption by BitLocker Drive …	System	N	N
24702	Read-only BitLocker Drive Encryption policy has been applied to volume Volume.	System	N	N
24703	Failed to determine whether volume Volume should be excluded from enforcement by …	System	N	N
24704	BitLocker Drive Encryption metadata was found to use unencrypted integrity …	System	N	N
24705	TPM protector ProtectorGUID binding BindingGUID final PCR values did not match …	System	N	N
24706	TPM protector ProtectorGUID binding BindingGUID final PCR values did not match …	System	N	N
24707	TPM protector ProtectorGUID binding BindingGUID final PCR values did not match …	System	N	N
24708	TPM protector ProtectorGUID binding BindingGUID final PCR values did not match …	System	N	N
24709	This event contains the boot-time final TPM PCR values and TCG log data.	System	N	N
24710	There was a problem communicating with the TPM at boot.	System	N	N
24711	A V2 TPM protector was used to start Windows.	System	N	N
24712	The TPM was not available at boot.	System	N	N
24713	The Inline Crypto Engine hardware did not produce the expected cryptographic …	System	N	N
24720	A TPM protector binding failed to unlock the volume despite matching the …	System	N	N
24721	A V2 TPM protector could not be used to start Windows.	System	N	N
24722	A hardware protected key was not provisioned for the volume.	System	N	N
24723	A hardware protected key was not used for the volume.	System	N	N

Event ID 24577: Encryption of volume Volume started.

Channel: System

Message #

Encryption of volume %2 started.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24578: Encryption of volume Volume stopped.

Channel: System

Message #

Encryption of volume %2 stopped.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24579: Encryption of volume Volume completed.

Channel: System

Message #

Encryption of volume %2 completed.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24580: Decryption of volume Volume started.

Channel: System

Message #

Decryption of volume %2 started.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24581: Decryption of volume Volume stopped.

Channel: System

Message #

Decryption of volume %2 stopped.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24582: Decryption of volume Volume completed.

Channel: System

Message #

Decryption of volume %2 completed.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24583: Conversion worker thread for volume Volume was started.

Channel: System

Message #

Conversion worker thread for volume %2 was started.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24584: Conversion worker thread for volume Volume was temporarily stopped.

Channel: System

Message #

Conversion worker thread for volume %2 was temporarily stopped.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24585: Auto-unlock enabled for volume Volume.

Channel: System

Message #

Auto-unlock enabled for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24586: An error was encountered converting volume Volume.

Channel: System

Message #

An error was encountered converting volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24587: Auto-unlock disabled for volume Volume.

Channel: System

Message #

Auto-unlock disabled for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24588: The conversion operation on volume Volume encountered a bad sector error.

Channel: System

Description

The conversion operation on volume Volume encountered a bad sector error. Please validate the data on this volume.

Message #

The conversion operation on volume %2 encountered a bad sector error. Please validate the data on this volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24589: Failed to enable auto-unlock for volume Volume.

Channel: System

Message #

Failed to enable auto-unlock for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24590: Failed to disable auto-unlock for volume Volume.

Channel: System

Message #

Failed to disable auto-unlock for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24591: Auto-unlocking failed for volume Volume.

Channel: System

Message #

Auto-unlocking failed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24592: An attempt to automatically restart conversion on volume Volume failed.

Channel: System

Message #

An attempt to automatically restart conversion on volume %2 failed.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24593: Metadata write: Volume Volume returning errors while trying to modify metadata.

Channel: System

Description

Metadata write: Volume Volume returning errors while trying to modify metadata. If failures continue, decrypt volume.

Message #

Metadata write: Volume %2 returning errors while trying to modify metadata. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24594: Metadata rebuild: An attempt to write a copy of metadata on volume Volume failed and may appear as disk corruption.

Channel: System

Description

Metadata rebuild: An attempt to write a copy of metadata on volume Volume failed and may appear as disk corruption. If failures continue, decrypt volume.

Message #

Metadata rebuild: An attempt to write a copy of metadata on volume %2 failed and may appear as disk corruption. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24595: Volume Volume contains bad clusters.

Channel: System

Description

Volume Volume contains bad clusters. These clusters will be skipped during conversion.

Message #

Volume %2 contains bad clusters. These clusters will be skipped during conversion.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24596: No key file was found for Volume Volume during restart.

Channel: System

Message #

No key file was found for Volume %2 during restart.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24597: A corrupt key file was encountered for Volume Volume during restart.

Channel: System

Message #

A corrupt key file was encountered for Volume %2 during restart.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24598: No volume master key was retrieved in a key file during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24599: The TPM was not enabled during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24600: The SRK was found to be invalid during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24601: The PCRs did not match during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24602: No volume master key was retrieved from a key file during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24603: A boot application hash did not match expected value during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24604: The boot configuration options did not match expected values during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24605: No volume master key was retrieved from a PIN during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24606: No volume master key was retrieved from a recovery password during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24607: A valid key was found during the last restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24608: An unexpected error was encountered attempting to retrieve the volume master key during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24609: A key was not available from required sources during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24610: Metadata commit: Not all copies of metadata on volume Volume could be written.

Channel: System

Description

Metadata commit: Not all copies of metadata on volume Volume could be written. If failures continue, decrypt volume.

Message #

Metadata commit: Not all copies of metadata on volume %2 could be written. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24611: Metadata commit: No copies of metadata on volume Volume could be written.

Channel: System

Description

Metadata commit: No copies of metadata on volume Volume could be written. If failures continue, decrypt volume.

Message #

Metadata commit: No copies of metadata on volume %2 could be written. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24612: Metadata commit: Metadata update could not be flushed.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24613: Metadata commit: An attempt to verify metadata update on volume Volume failed at read.

Channel: System

Description

Metadata commit: An attempt to verify metadata update on volume Volume failed at read. If failures continue, decrypt volume.

Message #

Metadata commit: An attempt to verify metadata update on volume %2 failed at read. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24614: Metadata commit: Update verification of metadata on volume Volume failed.

Channel: System

Description

Metadata commit: Update verification of metadata on volume Volume failed. If failures continue, decrypt volume.

Message #

Metadata commit: Update verification of metadata on volume %2 failed. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24615: Metadata initial read: Primary metadata record on volume Volume could not be found.

Channel: System

Description

Metadata initial read: Primary metadata record on volume Volume could not be found. Volume needs recovery.

Message #

Metadata initial read: Primary metadata record on volume %2 could not be found. Volume needs recovery.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24616: Metadata initial read: Failover metadata record on volume Volume could not be found.

Channel: System

Description

Metadata initial read: Failover metadata record on volume Volume could not be found. Volume needs recovery.

Message #

Metadata initial read: Failover metadata record on volume %2 could not be found. Volume needs recovery.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24617: Metadata initial read: Failover metadata record on volume Volume used.

Channel: System

Description

Metadata initial read: Failover metadata record on volume Volume used. If failures continue, decrypt volume.

Message #

Metadata initial read: Failover metadata record on volume %2 used. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24618: Metadata check: Metadata record on volume Volume could not be read and has been marked for rebuild.

Channel: System

Description

Metadata check: Metadata record on volume Volume could not be read and has been marked for rebuild. If failures continue, decrypt volume.

Message #

Metadata check: Metadata record on volume %2 could not be read and has been marked for rebuild. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24619: Metadata rebuild: An attempt build a new set of metadata on Volume failed at commit and may appear as disk corruption.

Channel: System

Description

Metadata rebuild: An attempt build a new set of metadata on Volume failed at commit and may appear as disk corruption. If failures continue, decrypt volume.

Message #

Metadata rebuild: An attempt build a new set of metadata on %2 failed at commit and may appear as disk corruption. If failures continue, decrypt volume.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24620: Encrypted volume check: Volume information on Volume cannot be read.

Channel: System

Message #

Encrypted volume check: Volume information on %2 cannot be read.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24621: Initial state check: Rolling volume conversion transaction on Volume.

Channel: System

Message #

Initial state check: Rolling volume conversion transaction on %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24622: BIOS/TCG Memory Overwrite Control: Error finding TPM driver.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24623: BIOS/TCG Memory Overwrite Control: Error registering TPM device interface.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24624: BIOS/TCG Memory Overwrite Control: Error changing value.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24625: A valid BitLocker key was found during the last restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24626: The auto-unlock master key was not available from the operating system volume.

Channel: System

Description

The auto-unlock master key was not available from the operating system volume. Retry the operation via the BitLocker WMI interface.

Message #

The auto-unlock master key was not available from the operating system volume.  Retry the operation via the BitLocker WMI interface.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24627: Boot debugging is enabled on Bootmgr so TPM based keys cannot be obtained.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24628: The partition size specified in the partition table is smaller than the size of the file system contained by that partition.

Channel: System

Description

The partition size specified in the partition table is smaller than the size of the file system contained by that partition. BitLocker TPM based keys cannot be used until the size of the partition calculated from the partition table is consistent with the size of the file system calculated from the bytes per sector and number of sectors fields in the boot sector.

Message #

The partition size specified in the partition table is smaller than the size of the file system contained by that partition.  BitLocker TPM based keys cannot be used until the size of the partition calculated from the partition table is consistent with the size of the file system calculated from the bytes per sector and number of sectors fields in the boot sector.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24629: The system firmware failed to enable overwriting of system memory on restart.

Channel: System

Description

The system firmware failed to enable overwriting of system memory on restart. The firmware should be upgraded.

Message #

The system firmware failed to enable overwriting of system memory on restart. The firmware should be upgraded.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24630: Bootmgr failed to find a BitLocker key file for Volume Volume.

Channel: System

Message #

Bootmgr failed to find a BitLocker key file for Volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24631: Bootmgr detected corruption in the BitLocker key file for Volume Volume.

Channel: System

Message #

Bootmgr detected corruption in the BitLocker key file for Volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24632: Bootmgr failed to obtain the BitLocker volume master key from the key file contents.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24633: Bootmgr determined that the TPM is disabled.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24634: Bootmgr determined that the authorization data for the SRK of the TPM is incompatible with BitLocker.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24635: Bootmgr failed to obtain the BitLocker volume master key from the TPM because the PCRs did not match.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24636: Bootmgr failed to obtain the BitLocker volume master key from the TPM.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24637: A boot application hash did not match the expected value during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24638: Bootmgr failed to obtain the BitLocker volume master key from the TPM + PIN.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24639: Bootmgr failed to obtain the BitLocker volume master key from the recovery password.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24640: A valid BitLocker key was found during the last restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24641: An unexpected error was encountered attempting to retrieve the BitLocker volume master key during restart.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24642: An internal BitLocker self-test failed for drive Volume.

Channel: System

Description

An internal BitLocker self-test failed for drive Volume. BitLocker cannot continue encrypting data. Contact your system administrator.

Message #

An internal BitLocker self-test failed for drive %2. BitLocker cannot continue encrypting data. Contact your system administrator.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24643: Bootmgr failed to obtain the BitLocker volume master key from the TPM + enhanced PIN.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24644: An internal BitLocker self-test failed for drive Volume when switching from raw mode to filtering mode.

Channel: System

Description

An internal BitLocker self-test failed for drive Volume when switching from raw mode to filtering mode. BitLocker cannot continue encrypting data on this drive. Contact your system administrator.

Message #

An internal BitLocker self-test failed for drive %2 when switching from raw mode to filtering mode. BitLocker cannot continue encrypting data on this drive. Contact your system administrator.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24645: Bootmgr failed to obtain the BitLocker volume master key from the network key protector.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24646: Encryption of the used space on volume Volume started.

Channel: System

Message #

Encryption of the used space on volume %2 started.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24647: Encryption of the used space on volume Volume stopped.

Channel: System

Message #

Encryption of the used space on volume %2 stopped.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24648: Encryption of the used space on volume Volume completed.

Channel: System

Message #

Encryption of the used space on volume %2 completed.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24649: Wiping of free space on volume Volume started.

Channel: System

Message #

Wiping of free space on volume %2 started.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24650: Wiping of free space on volume Volume stopped.

Channel: System

Message #

Wiping of free space on volume %2 stopped.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24651: Wiping of free space on volume Volume completed.

Channel: System

Message #

Wiping of free space on volume %2 completed.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24652: A recovery password was used to start Windows.

Channel: System

Message #

A recovery password was used to start Windows.
Protector ID: %5.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24653: Bootmgr failed to obtain the BitLocker volume master key from the password.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24654: A recovery key was used to start Windows.

Channel: System

Message #

A recovery key was used to start Windows.
Protector ID: %5.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24655: The BitLocker driver has started a self-healing operation on the metadata of volume Volume.

Channel: System

Message #

The BitLocker driver has started a self-healing operation on the metadata of volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24656: The BitLocker driver has successfully completed a self-healing operation on the metadata of volume Volume.

Channel: System

Message #

The BitLocker driver has successfully completed a self-healing operation on the metadata of volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24657: Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot was disabled.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24658: Bootmgr failed to obtain the BitLocker volume master key from the TPM because Secure Boot configuration changed unexpectedly.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24659: Device Lock was triggered due to too many incorrect password attempts.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24660: BitLocker encryption on write started for volume Volume.

Channel: System

Message #

BitLocker encryption on write started for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24661: BitLocker free space sweep started for volume Volume.

Channel: System

Message #

BitLocker free space sweep started for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24662: BitLocker free space sweep stopped for volume Volume.

Channel: System

Message #

BitLocker free space sweep stopped for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24663: BitLocker free space sweep completed for volume Volume.

Channel: System

Message #

BitLocker free space sweep completed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24664: BitLocker finalization sweep started for volume Volume.

Channel: System

Message #

BitLocker finalization sweep started for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24665: BitLocker finalization sweep paused for volume Volume.

Channel: System

Message #

BitLocker finalization sweep paused for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24666: BitLocker finalization sweep resumed for volume Volume.

Channel: System

Message #

BitLocker finalization sweep resumed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24667: BitLocker finalization sweep completed for volume Volume.

Channel: System

Message #

BitLocker finalization sweep completed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24668: BitLocker encryption on write failed for volume Volume due to disk I/O error.

Channel: System

Description

BitLocker encryption on write failed for volume Volume due to disk I/O error. Check the disk for bad sectors.

Message #

BitLocker encryption on write failed for volume %2 due to disk I/O error. Check the disk for bad sectors.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24669: BitLocker finalization sweep failed for volume Volume due to disk I/O error.

Channel: System

Description

BitLocker finalization sweep failed for volume Volume due to disk I/O error. Check the disk for bad sectors.

Message #

BitLocker finalization sweep failed for volume %2 due to disk I/O error. Check the disk for bad sectors.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24670: Disk containing volume Volume is employing non-volatile caching software which does not support control over its caching policies.

Channel: System

Description

Disk containing volume is employing non-volatile caching software which does not support control over its caching policies. This may temporarily impact BitLocker's ability to fully secure your data.

Message #

Disk containing volume %2 is employing non-volatile caching software which does not support control over its caching policies. This may temporarily impact BitLocker's ability to fully secure your data.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24671: Disk containing volume Volume is employing non-volatile caching software which is experiencing problems.

Channel: System

Description

Disk containing volume Volume is employing non-volatile caching software which is experiencing problems. This may temporarily impact BitLocker's ability to fully secure your data. Contact disk manufacturer for an updated software.

Message #

Disk containing volume %2 is employing non-volatile caching software which is experiencing problems. This may temporarily impact BitLocker's ability to fully secure your data. Contact disk manufacturer for an updated software.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24672: Device Lock was triggered due to Device Lockout state validation failure.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24673: Drive Volume is no longer automatically managed by device encryption.

Channel: System

Message #

Drive %2 is no longer automatically managed by device encryption.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24674: Drive Volume is now automatically managed by device encryption.

Channel: System

Message #

Drive %2 is now automatically managed by device encryption.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24675: WIM hash generation paused for volume Volume.

Channel: System

Message #

WIM hash generation paused for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24676: WIM hash generation resumed for volume Volume.

Channel: System

Message #

WIM hash generation resumed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24677: WIM hash generation completed for volume Volume.

Channel: System

Message #

WIM hash generation completed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24678: WIM hash generation failed for volume Volume.

Channel: System

Message #

WIM hash generation failed for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24679: WIM hashes will be deleted for volume Volume.

Channel: System

Message #

WIM hashes will be deleted for volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24680: Bootmgr failed to unseal VMK using the TPM

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24681: Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to acquire protocol handle.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24682: Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to get IP address.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24683: Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to create request.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24684: Bootmgr failed to obtain the BitLocker volume master key from the network key protector: failed to send request.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24685: Bootmgr failed to obtain the BitLocker volume master key from the network key protector: invalid response.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24686: Bootmgr failed to obtain the BitLocker volume master key from the network boot protector.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24687: BitLocker timed out attempting to enumerate bands during volume discovery on this hardware encrypting drive.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24688: Failed to read metadata from logical copy.

Channel: System

Description

Failed to read metadata from logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.

Message #

Failed to read metadata from logical copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24689: Attempted to read metadata from logical copy.

Channel: System

Description

Attempted to read metadata from logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.

Message #

Attempted to read metadata from logical copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24690: Attempted to fix metadata logical copies.

Channel: System

Description

Attempted to fix metadata logical copies. Volume: Volume, ManageFlags: WritePhase.

Message #

Attempted to fix metadata logical copies. Volume: %2, ManageFlags: %3

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24691: Failed to verify metadata logical copy against Primary.

Channel: System

Description

Failed to verify metadata logical copy against Primary. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.

Message #

Failed to verify metadata logical copy against Primary. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24692: Failed to verify metadata file against Primary copy.

Channel: System

Description

Failed to verify metadata file against Primary copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies:TotalCopies.

Message #

Failed to verify metadata file against Primary copy. Volume: %2, Start Offset: %3, Read Length: %4, Copy: %5, Number of Copies:%6

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24693: Failed to register metadata check worker.

Channel: System

Description

Failed to register metadata check worker. Volume: Volume.

Message #

Failed to register metadata check worker. Volume: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24694: Metadata check worker started.

Channel: System

Description

Metadata check worker started. Volume: ErrorCode.

Message #

Metadata check worker started. Volume: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24695: Metadata check worker completed.

Channel: System

Description

Metadata check worker completed. Volume: ErrorCode.

Message #

Metadata check worker completed. Volume: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24696: Successfully created metadata file.

Channel: System

Description

Successfully created metadata file. Volume: Volume, Offset: Offset, Read Length: Length, Copy: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.

Message #

Successfully created metadata file. Volume: %2, Offset: %3, Read Length: %4, Copy: %5, Number of Copies: %6, TpAllocationSize: %7

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64	Successfully created metadata file. Volume.
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24697: Failed to read a valid metadata copy.

Channel: System

Description

Failed to read a valid metadata copy. Volume: Volume, Start Offset: Offset, Index: Copy.

Message #

Failed to read a valid metadata copy. Volume: %2, Start Offset: %3, Index: %5

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24698: Failed to fix metadata logical copy.

Channel: System

Description

Failed to fix metadata logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Source Index: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.

Message #

Failed to fix metadata logical copy. Volume: %2, Start Offset: %3,  Read Length: %4, Source Index: %5, Number of Copies: %6, TpAllocationSize: %7

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24699: Attempted to check metadata logical copies.

Channel: System

Description

Attempted to check metadata logical copies. Volume: Volume, ManageFlags: WritePhase.

Message #

Attempted to check metadata logical copies. Volume: %2, ManageFlags: %3

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24700: Successfully fixed metadata logical copy.

Channel: System

Description

Successfully fixed metadata logical copy. Volume: Volume, Start Offset: Offset, Read Length: Length, Source Index: Copy, Number of Copies: TotalCopies, TpAllocationSize: SlabSize.

Message #

Successfully fixed metadata logical copy. Volume: %2, Start Offset: %3,  Read Length: %4, Source Index: %5, Number of Copies: %6, TpAllocationSize: %7

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`Offset` UInt64
`Length` UInt64
`Copy` UInt64
`TotalCopies` UInt64
`SlabSize` UInt64

Event ID 24701: Volume Volume has been excluded from device encryption by BitLocker Drive Encryption policy.

Channel: System

Description

Volume Volume has been excluded from device encryption by BitLocker Drive Encryption policy. Excluded Hardware ID: 'HardwareID'.

Message #

Volume %2 has been excluded from device encryption by BitLocker Drive Encryption policy. Excluded Hardware ID: '%3'

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`HardwareID` UnicodeString

Event ID 24702: Read-only BitLocker Drive Encryption policy has been applied to volume Volume.

Channel: System

Message #

Read-only BitLocker Drive Encryption policy has been applied to volume %2.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24703: Failed to determine whether volume Volume should be excluded from enforcement by BitLocker Drive Encryption policy.

Channel: System

Message #

Failed to determine whether volume %2 should be excluded from enforcement by BitLocker Drive Encryption policy.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24704: BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume Volume.

Channel: System

Message #

BitLocker Drive Encryption metadata was found to use unencrypted integrity validation hash on volume %1.

Fields #

Name	Description
`Volume` UnicodeString
`VolumeGUID` GUID
`State` HexInt32
`Direction` HexInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`StateOffset` HexInt64
`StateSize` HexInt32

Event ID 24705: TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.

Channel: System

Message #

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields #

Name	Description
`ContextFlags` HexInt32
`ProtectorGUID` GUID
`BindingGUID` GUID
`BindingCreationScenario` UInt32
`DateTimeOfSeal` FILETIME
`DateTimeOfMismatch` FILETIME
`PcrBitmap` HexInt32
`TcgLogIsValidStatus` HexInt32
`BindingDatumIsValidStatus` HexInt32
`MismatchedPcrInfoFlags` HexInt32
`MismatchedPcr` UInt32
`ExpectedHashAlgorithm` HexInt32
`ExpectedHashAlgorithmSize` UInt16
`ObservedHashAlgorithm` HexInt32
`ObservedHashAlgorithmSize` UInt16
`ExpectedEventsCount` UInt16
`ObservedEventsCount` UInt16
`MismatchedEvent` UInt16
`ExpectedEventType` HexInt32
`ObservedEventType` HexInt32
`ExpectedDigest` Binary
`ObservedDigest` Binary
`ExpectedEventLabel` UnicodeString
`ObservedEventLabel` UnicodeString
`SealedPcrValuesSize` UInt16
`SealedPcrValues` Binary

Event ID 24706: TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.

Channel: System

Message #

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields #

Name	Description
`ContextFlags` HexInt32
`ProtectorGUID` GUID
`BindingGUID` GUID
`BindingCreationScenario` UInt32
`DateTimeOfSeal` FILETIME
`DateTimeOfMismatch` FILETIME
`PcrBitmap` HexInt32
`TcgLogIsValidStatus` HexInt32
`BindingDatumIsValidStatus` HexInt32
`MismatchedPcrInfoFlags` HexInt32
`MismatchedPcr` UInt32
`ExpectedHashAlgorithm` HexInt32
`ExpectedHashAlgorithmSize` UInt16
`ObservedHashAlgorithm` HexInt32
`ObservedHashAlgorithmSize` UInt16
`ExpectedEventsCount` UInt16
`ObservedEventsCount` UInt16
`MismatchedEvent` UInt16
`ExpectedEventType` HexInt32
`ObservedEventType` HexInt32
`ExpectedDigest` Binary
`ObservedDigest` Binary
`ExpectedEventLabel` UnicodeString
`SealedPcrValuesSize` UInt16
`SealedPcrValues` Binary

Event ID 24707: TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.

Channel: System

Message #

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields #

Name	Description
`ContextFlags` HexInt32
`ProtectorGUID` GUID
`BindingGUID` GUID
`BindingCreationScenario` UInt32
`DateTimeOfSeal` FILETIME
`DateTimeOfMismatch` FILETIME
`PcrBitmap` HexInt32
`TcgLogIsValidStatus` HexInt32
`BindingDatumIsValidStatus` HexInt32
`MismatchedPcrInfoFlags` HexInt32
`MismatchedPcr` UInt32
`ExpectedHashAlgorithm` HexInt32
`ExpectedHashAlgorithmSize` UInt16
`ObservedHashAlgorithm` HexInt32
`ObservedHashAlgorithmSize` UInt16
`ExpectedEventsCount` UInt16
`ObservedEventsCount` UInt16
`MismatchedEvent` UInt16
`ExpectedEventType` HexInt32
`ObservedEventType` HexInt32
`ExpectedDigest` Binary
`ObservedDigest` Binary
`ObservedEventLabel` UnicodeString
`SealedPcrValuesSize` UInt16
`SealedPcrValues` Binary

Event ID 24708: TPM protector ProtectorGUID binding BindingGUID final PCR values did not match those observed in the TPM.

Channel: System

Message #

TPM protector %2 binding %3 final PCR values did not match those observed in the TPM

Fields #

Name	Description
`ContextFlags` HexInt32
`ProtectorGUID` GUID
`BindingGUID` GUID
`BindingCreationScenario` UInt32
`DateTimeOfSeal` FILETIME
`DateTimeOfMismatch` FILETIME
`PcrBitmap` HexInt32
`TcgLogIsValidStatus` HexInt32
`BindingDatumIsValidStatus` HexInt32
`MismatchedPcrInfoFlags` HexInt32
`MismatchedPcr` UInt32
`ExpectedHashAlgorithm` HexInt32
`ExpectedHashAlgorithmSize` UInt16
`ObservedHashAlgorithm` HexInt32
`ObservedHashAlgorithmSize` UInt16
`ExpectedEventsCount` UInt16
`ObservedEventsCount` UInt16
`MismatchedEvent` UInt16
`ExpectedEventType` HexInt32
`ObservedEventType` HexInt32
`ExpectedDigest` Binary
`ObservedDigest` Binary
`SealedPcrValuesSize` UInt16
`SealedPcrValues` Binary

Event ID 24709: This event contains the boot-time final TPM PCR values and TCG log data.

Channel: System

Fields #

Name	Description
`DateTime` FILETIME
`IsSecureBootOn` Boolean
`TcgLogHashAlgorithm` HexInt32
`TcgLogHashAlgorithmSize` UInt16
`AllFinalPcrValuesPcrBitmap` HexInt32
`CountPcrsInAllFinalPcrValuesPcrBitmap` UInt16
`AllPcrDatasPcrBitmap` HexInt32
`CountPcrsInAllPcrDatasPcrBitmap` UInt16
`FinalPcrValuesSize` UInt32
`FinalPcrValues` Binary
`SealedPcrDigestsDatumsSize` UInt32
`SealedPcrDigestsDatums` Binary

Event ID 24710: There was a problem communicating with the TPM at boot.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24711: A V2 TPM protector was used to start Windows.

Channel: System

Message #

A V2 TPM protector was used to start Windows.
Binding ID: %5.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24712: The TPM was not available at boot.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24713: The Inline Crypto Engine hardware did not produce the expected cryptographic output.

Channel: System

Description

The Inline Crypto Engine hardware did not produce the expected cryptographic output. Volume: Volume.

Message #

The Inline Crypto Engine hardware did not produce the expected cryptographic output. Volume: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24720: A TPM protector binding failed to unlock the volume despite matching the expected TPM unlock state.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24721: A V2 TPM protector could not be used to start Windows.

Channel: System

Message #

A V2 TPM protector could not be used to start Windows.
Binding ID: %5.

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32
`VolumeGUID` GUID
`OptionalGUID` GUID
`Flags` HexInt32

Event ID 24722: A hardware protected key was not provisioned for the volume.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Event ID 24723: A hardware protected key was not used for the volume.

Channel: System

Fields #

Name	Description
`ErrorCode` HexInt32
`Volume` UnicodeString
`WritePhase` HexInt32

Provenance

ETW provider GUID 651df93b-5053-4d1e-94c5-f6e6d25908d0

Defined in fvevol.sys, the binary that emits these events.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB