detection.wiki

Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging

EventTitleChannelSampleRule
200Windows Activation logged the following information.OperationalNN
201Windows Activation logged the following error: shErrorCode.OperationalNN

Event ID 200: Windows Activation logged the following information.

#
Channel
Operational

Message #

Windows Activation logged the following information:
%1

Fields #

NameDescription
shKernelCacheValues UnicodeString

Event ID 201: Windows Activation logged the following error: shErrorCode.

#
Channel
Operational

Message #

Windows Activation logged the following error: %1

Fields #

NameDescription
shErrorCode UnicodeString

Provenance

ETW provider GUID fb829150-cd7d-44c3-af5b-711a3c31cedc

Defined in sppcommdlg.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB