Microsoft-Windows-ShieldedVM-ProvisioningService

181 events across 2 channels

Event	Title	Channel	Sample
0	Cannot continue because a failure occurred while provisioning.	Operational	N
1	A general error occurred while provisioning the machine.	Operational	N
2	Cannot provision because the Shielded VM provisioning data cannot be decrypted.	Operational	N
3	Cannot provision because the data from the remote TPM reflects an insecure …	Operational	N
4	Cannot provision because an error was detected while communicating with the …	Operational	N
5	Cannot continue because the target machine detected a TPM failure.	Operational	N
6	Cannot continue because the provisioning agent was unable to retrieve the …	Operational	N
7	Cannot provision because the template disk attached to the machine is invalid.	Operational	N
8	Cannot provision because the volume signature catalog from the template disk is …	Operational	N
9	Cannot provision because the provided Shielded VM provisioning data is not …	Operational	N
10	The template manager has determined that the template disk signature is invalid.	Operational	N
11	Unable to continue because a failure occurred while attempting to rekey the …	Operational	N
12	An error occurred while processing the Shielded VM provisioning data content.	Operational	N
13	Cannot provision because the Shielded VM provisioning data failed to write to …	Operational	N
14	The target machine?	Operational	N
15	Cannot continue because the provided Shielded VM provisioning data failed to …	Operational	N
16	Cannot continue because the remote machine disconnected unexpectedly.	Operational	N
17	Cannot continue because a failure occurred when accessing the secure storage.	Operational	N
18	Cannot provision because the volume signature catalog from the template disk is …	Operational	N
19	Unable to create the Unattend.	Operational	N
20	An error occurred while processing the Shielded VM provisioning data content.	Operational	N
21	Cannot continue because Virtual Machine attestation failed during provisioning …	Operational	N
22	Cannot continue because a failure occurred while calculating a hash of the …	Operational	N
23	Cannot continue because the signature file in the template disk is missing.	Operational	N
24	Cannot continue because the TPM is missing the SRK.	Operational	N
25	Provisioning cannot continue because the provisioning security process could not …	Operational	N
26	Provisioning cannot continue because the template disk does not have an expected …	Operational	N
27	Provisioning cannot continue because the template disk has an unexpected volume …	Operational	N
28	Provisioning cannot continue because the disk associated with the provisioned VM …	Operational	N
29	Provisioning cannot continue because the operating system associated with the …	Operational	N
30	Provisioning cannot continue because the sealing values associated with the …	Operational	N
31	Provisioning cannot continue because the initialization data required by the …	Operational	N
32	Provisioning may not continue because the UEFI database could not be loaded.	Operational	N
33	Provisioning may not continue because a launch authority could not be …	Operational	N
34	Provisioning failed to extend the secure boot PCR.	Operational	N
35	Provisioning failed to extend the boot lock PCR.	Operational	N
36	Provisioning could not generate the server key or TPM operations.	Operational	N
37	The version of communication required by Provisioning was not understood by the …	Operational	N
38	The template disk uses a version of communication not allowed by Provisioning.	Operational	N
39	Msps_ProvisioningService: Timeout detected.	Operational	N
40	An error was provided to the provisioning service of behalf of another …	Operational	N
41	The attempt to prepare the specialized machine failed.	Operational	N
42	Provisioning agent reported a failure to unwrap the protected data.	Operational	N
43	The target has been deemed unhealthy or not secure by attestation, provisioning …	Operational	N
44	Due to prior health assessment operations the provisioning security process has …	Operational	N
45	The provisioning service received a connection request from an unknown machine.	Operational	N
46	The provisioning service received a connection request from a machine in an …	Operational	N
47	The virtual machine cannot be shielded because its virtual disk identifier …	Operational	N
48	The VM boot disk is a differencing disk which is not supported by the …	Operational	N
301	WMI call failed.	Debug	N
301	Event ID 301	Operational	N
302	WMI call failed.	Debug	N
302	Event ID 302	Operational	N
303	Msps_ProvisioningService: Shielded VM provisioning session started.	Operational	N
304	Msps_ProvisioningService: Failed to start Shielded VM provisioning session.	Operational	N
305	Msps_ProvisioningService: Failed to start Shielded VM provisioning session.	Operational	N
306	Msps_ProvisioningService: Shielded VM provisioning session opened.	Operational	N
307	Msps_ProvisioningService: Shielded VM provisioning session closed.	Operational	N
308	Msps_ProvisioningJob removed.	Operational	N
309	Msps_ProvisioningService service activated.	Debug	N
309	Event ID 309	Operational	N
310	Msps_ProvisioningService service completed.	Debug	N
310	Event ID 310	Operational	N
311	Msps_ProvisioningJob: Received request to retrieve job.	Debug	N
311	Event ID 311	Operational	N
312	Msps_ProvisioningJob: Received request to delete job.	Debug	N
312	Event ID 312	Operational	N
313	Msps_ProvisioningJob found Uint instances.	Debug	N
313	Event ID 313	Operational	N
400	The provisioning process logged an unknown event.	Operational	N
401	The provisioning data has been received over the secure channel.	Operational	N
402	The fabric data has been received over the secure channel.	Operational	N
403	The provisioning data was successfully transferred over the secure channel.	Operational	N
404	The secure inputs are being processed by the provisioning service.	Operational	N
405	The VM being provisioned is communicating with the remote TPM.	Operational	N
406	Provisioning started.	Operational	N
407	The Shielded VM was successfully provisioned.	Operational	N
408	The template manager is analyzing the template disk.	Operational	N
409	The template manager finished analyzing the template disk.	Operational	N
410	The template manager is sealing the template disk.	Operational	N
411	The template manager has sealed the template disk.	Operational	N
412	The specialization agent is applying the fabric data to the template disk.	Operational	N
413	The specialization agent has finished applying the fabric data to the template …	Operational	N
414	The provisioning agent has started executing the plugins for the Shielded VM.	Operational	N
415	The provisioning agent has finished executing the plugins for the Shielded VM.	Operational	N
416	A specialization value was replaced in the Shielded VM's unattend file.	Operational	N
417	The provisioning agent was started and is communicating with the host machine.	Operational	N
418	The provisioning process was started within the Shielded VM and is communicating …	Operational	N
419	The UEFI variables were received by the provisioning process.	Operational	N
420	An attestation event was received from the provisioning process.	Operational	N
421	A diagnostic attestation event was received from the provisioning process.	Operational	N
422	No instance of Name was found in the unattend file included in the provisioning …	Operational	N
423	The template manager is skipping verification of the signature catalog on disk …	Operational	N
424	The template manager is skipping verification of the signature catalog on disk …	Operational	N
425	The template manager has updated the factory policy of the provisioned VM …	Operational	N
426	The template manager has set the sealing values of the provisioned VM Machine …	Operational	N
427	The provisioning agent is starting the Execute pass on the provisioned VM …	Operational	N
428	The provisioning agent has finished the Execute pass on the provisioned VM …	Operational	N
429	The provisioning agent has finished the platform update on the provisioned VM …	Operational	N
430	The provisioning agent is starting to predict the sealing values of the …	Operational	N
431	The provisioning agent is starting the Finalize pass on the provisioned VM …	Operational	N
432	The provisioning agent has finished the Finalize pass on the provisioned VM …	Operational	N
433	The provisioning agent is allowed to use the UEFI CA per current policy Machine …	Operational	N
434	The provisioning service is selecting a launch authority Machine ID.	Debug	N
434	Event ID 434	Operational	N
435	The template disk has declared its current version for the purposes of …	Operational	N
436	The provisioning service has accepted a communications version supported by the …	Operational	N
437	Received status update from the template manager.	Debug	N
437	Event ID 437	Operational	N
438	The template manager successfully validated the image hash.	Operational	N
439	The template manager completed rolling the FVEK.	Operational	N
440	The template manager successfully protected the volume.	Operational	N
441	The provisioning Agent encountered an unknown data section.	Debug	N
441	Event ID 441	Operational	N
442	An external BitLocker key was created for a template volume.	Operational	N
443	An encrypted BitLocker external key for a template volume was written to disk.	Operational	N
500	Ptp Session Event.	Debug	N
500	Event ID 500	Operational	N
501	Ptp Session Event.	Debug	N
501	Event ID 501	Operational	N
502	Invalid payload in error notification.	Debug	N
502	Event ID 502	Operational	N
503	Invalid attestation payload in notification.	Debug	N
503	Event ID 503	Operational	N
504	uint attestation items received from the attestation diagnostics log.	Debug	N
504	Event ID 504	Operational	N
505	An attestation log item was too short to be valid (uint bytes).	Debug	N
505	Event ID 505	Operational	N
506	The authoritative event log was deemed invalid.	Debug	N
506	Event ID 506	Operational	N
507	The authoritative event log is missing an event.	Debug	N
507	Event ID 507	Operational	N
508	The attestation log is missing an event.	Debug	N
508	Event ID 508	Operational	N
509	The data in the attestation event is incorrect.	Debug	N
509	Event ID 509	Operational	N
510	The attestation log is invalid.	Debug	N
510	Event ID 510	Operational	N
511	An unexpected attestation event was encountered.	Debug	N
511	Event ID 511	Operational	N
512	The attestation log contained an event which was incorrect.	Debug	N
512	Event ID 512	Operational	N
513	The attestation event log contains an unknown event.	Debug	N
513	Event ID 513	Operational	N
514	An attestation event log item is corrupt.	Debug	N
514	Event ID 514	Operational	N
515	The name of the attestation event log item is Name.	Debug	N
515	Event ID 515	Operational	N
516	The attestation event log item name has no name information.	Debug	N
516	Event ID 516	Operational	N
517	The attestation event log item WCBL payload appears corrupt.	Debug	N
517	Event ID 517	Operational	N
518	PCR Index: PCRIndex, Zero-based order relative to PCR: RelativeOrderToPCR, …	Debug	N
518	Event ID 518	Operational	N
519	The event data is too short or otherwise corrupt and does not contain a TrEE …	Debug	N
519	Event ID 519	Operational	N
520	TrEE authoritative variable data payload found.	Debug	N
520	Event ID 520	Operational	N
521	TrEE attestation variable data payload found.	Debug	N
521	Event ID 521	Operational	N
522	The process of converting an existing VM has started.	Debug	N
522	Event ID 522	Operational	N
523	A call has failed during the conversion process.	Debug	N
523	Event ID 523	Operational	N
524	The temporary VM will be named Name.	Debug	N
524	Event ID 524	Operational	N
525	The original VM's boot disk is at Name.	Debug	N
525	Event ID 525	Operational	N
526	The temporary VM has been created with identifier Name.	Debug	N
526	Event ID 526	Operational	N
527	The disk at Name has been added to the temporary VM.	Debug	N
527	Event ID 527	Operational	N
528	A KVP value has been retrieved from the temporary VM: Name / Value.	Debug	N
528	Event ID 528	Operational	N
529	The target UEFI db variable does not match the expected value and adoption is …	Operational	N
530	The target UEFI dbx variable does not match the expected value and adoption is …	Operational	N
531	Provisioning is unable to verify the Provisioning Agent stack version in the …	Operational	N
532	The grandfathering utility disk and the boot disk of the original VM appear to …	Debug	N
532	Event ID 532	Operational	N
533	The VM boot disk is not a differencing disk.	Debug	N
533	Event ID 533	Operational	N

Event ID 0: Cannot continue because a failure occurred while provisioning.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because a failure occurred while provisioning. The message code is unknown, which can happen if the operating system of the VM is newer than that of the host.

Message #

Cannot continue because a failure occurred while provisioning. The message code is unknown, which can happen if the operating system of the VM is newer than that of the host.

Fields #

Name	Description
`MachineID` GUID
`Source` UInt32
`DiagnosticID` UInt32
`FailureID` UInt32

Event ID 1: A general error occurred while provisioning the machine.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

A general error occurred while provisioning the machine. Unable to continue.

Message #

A general error occurred while provisioning the machine. Unable to continue.

Fields #

Name	Description
`MachineID` GUID
`SourceID` UInt32
`Win32ErrorCode` UInt32

Event ID 2: Cannot provision because the Shielded VM provisioning data cannot be decrypted.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the Shielded VM provisioning data cannot be decrypted.

Message #

Cannot provision because the Shielded VM provisioning data cannot be decrypted.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 3: Cannot provision because the data from the remote TPM reflects an insecure state.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the data from the remote TPM reflects an insecure state. This may be caused by signing changes in the target OS or the selection of UEFI secure boot variables in Hyper-V.

Message #

Cannot provision because the data from the remote TPM reflects an insecure state. This may be caused by signing changes in the target OS or the selection of UEFI secure boot variables in Hyper-V.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 4: Cannot provision because an error was detected while communicating with the target machine.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because an error was detected while communicating with the target machine.

Message #

Cannot provision because an error was detected while communicating with the target machine.

Fields #

Name	Description
`MachineID` GUID
`Win32ErrorCode` UInt32

Event ID 5: Cannot continue because the target machine detected a TPM failure.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the target machine detected a TPM failure. Verify that the target machine?s TPM is operational.

Message #

Cannot continue because the target machine detected a TPM failure. Verify that the target machine?s TPM is operational.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 6: Cannot continue because the provisioning agent was unable to retrieve the provisioning data due to a key error.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the provisioning agent was unable to retrieve the provisioning data due to a key error.

Message #

Cannot continue because the provisioning agent was unable to retrieve the provisioning data due to a key error.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 7: Cannot provision because the template disk attached to the machine is invalid.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the template disk attached to the machine is invalid.

Message #

Cannot provision because the template disk attached to the machine is invalid.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 8: Cannot provision because the volume signature catalog from the template disk is not properly signed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the volume signature catalog from the template disk is not properly signed.

Message #

Cannot provision because the volume signature catalog from the template disk is not properly signed.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 9: Cannot provision because the provided Shielded VM provisioning data is not applicable to the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the provided Shielded VM provisioning data is not applicable to the template disk. Retry with an applicable template disk or update your provisioning data.

Message #

Cannot provision because the provided Shielded VM provisioning data is not applicable to the template disk. Retry with an applicable template disk or update your provisioning data.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32
`TemplateNameFound` UnicodeString
`TemplateVersionFound` HexInt64

Event ID 10: The template manager has determined that the template disk signature is invalid.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager has determined that the template disk signature is invalid. The disk may have been modified since the time at which it was originally signed.

Message #

The template manager has determined that the template disk signature is invalid. The disk may have been modified since the time at which it was originally signed.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 11: Unable to continue because a failure occurred while attempting to rekey the encryption on the operating system volume in the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Unable to continue because a failure occurred while attempting to rekey the encryption on the operating system volume in the template disk.

Message #

Unable to continue because a failure occurred while attempting to rekey the encryption on the operating system volume in the template disk.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 12: An error occurred while processing the Shielded VM provisioning data content.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An error occurred while processing the Shielded VM provisioning data content.

Message #

An error occurred while processing the Shielded VM provisioning data content.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 13: Cannot provision because the Shielded VM provisioning data failed to write to disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the Shielded VM provisioning data failed to write to disk.

Message #

Cannot provision because the Shielded VM provisioning data failed to write to disk.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 14: The target machine?

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The target machine?s TPM is in an invalid state.

Message #

The target machine?s TPM is in an invalid state.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 15: Cannot continue because the provided Shielded VM provisioning data failed to load due to invalid content.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the provided Shielded VM provisioning data failed to load due to invalid content. Recreate the provisioning data and retry.

Message #

Cannot continue because the provided Shielded VM provisioning data failed to load due to invalid content. Recreate the provisioning data and retry.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 16: Cannot continue because the remote machine disconnected unexpectedly.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the remote machine disconnected unexpectedly.

Message #

Cannot continue because the remote machine disconnected unexpectedly.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 17: Cannot continue because a failure occurred when accessing the secure storage.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because a failure occurred when accessing the secure storage.

Message #

Cannot continue because a failure occurred when accessing the secure storage.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 18: Cannot provision because the volume signature catalog from the template disk is not properly signed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot provision because the volume signature catalog from the template disk is not properly signed.

Message #

Cannot provision because the volume signature catalog from the template disk is not properly signed.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 19: Unable to create the Unattend.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Unable to create the Unattend.xml. Verify the Shielded VM provisioning data contains a valid Unattend.xml before provisioning.

Message #

Unable to create the Unattend.xml. Verify the Shielded VM provisioning data contains a valid Unattend.xml before provisioning.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 20: An error occurred while processing the Shielded VM provisioning data content.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An error occurred while processing the Shielded VM provisioning data content.

Message #

An error occurred while processing the Shielded VM provisioning data content.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 21: Cannot continue because Virtual Machine attestation failed during provisioning from template.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Message #

Cannot continue because Virtual Machine attestation failed during provisioning from template. A common cause could be a change to the UEFI settings of the VM. Please check the event log for more details.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 22: Cannot continue because a failure occurred while calculating a hash of the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Message #

Cannot continue because a failure occurred while calculating a hash of the template disk. If this template has been successfully used before, then this may have been the result of a transient disk error.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 23: Cannot continue because the signature file in the template disk is missing.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the signature file in the template disk is missing.

Message #

Cannot continue because the signature file in the template disk is missing.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 24: Cannot continue because the TPM is missing the SRK.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Cannot continue because the TPM is missing the SRK.

Message #

Cannot continue because the TPM is missing the SRK.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 25: Provisioning cannot continue because the provisioning security process could not be launched.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the provisioning security process could not be launched. Check whether the Isolated User Mode component is installed on the host and has been turned on.

Message #

Provisioning cannot continue because the provisioning security process could not be launched. Check whether the Isolated User Mode component is installed on the host and has been turned on.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 26: Provisioning cannot continue because the template disk does not have an expected volume signature catalog file and this has not been authorized by ...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the template disk does not have an expected volume signature catalog file and this has not been authorized by the provisioning data.

Message #

Provisioning cannot continue because the template disk does not have an expected volume signature catalog file and this has not been authorized by the provisioning data.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 27: Provisioning cannot continue because the template disk has an unexpected volume signature catalog file and the provisioning data does not authorize...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the template disk has an unexpected volume signature catalog file and the provisioning data does not authorize this.

Message #

Provisioning cannot continue because the template disk has an unexpected volume signature catalog file and the provisioning data does not authorize this.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 28: Provisioning cannot continue because the disk associated with the provisioned VM could not be protected.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the disk associated with the provisioned VM could not be protected.

Message #

Provisioning cannot continue because the disk associated with the provisioned VM could not be protected.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 29: Provisioning cannot continue because the operating system associated with the provisioned VM could not be updated to support appropriate security m...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the operating system associated with the provisioned VM could not be updated to support appropriate security measures.

Message #

Provisioning cannot continue because the operating system associated with the provisioned VM could not be updated to support appropriate security measures.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 30: Provisioning cannot continue because the sealing values associated with the current boot configuration could not be properly predicted.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the sealing values associated with the current boot configuration could not be properly predicted.

Message #

Provisioning cannot continue because the sealing values associated with the current boot configuration could not be properly predicted.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 31: Provisioning cannot continue because the initialization data required by the boot configuration process could not be updated.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning cannot continue because the initialization data required by the boot configuration process could not be updated.

Message #

Provisioning cannot continue because the initialization data required by the boot configuration process could not be updated.

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 32: Provisioning may not continue because the UEFI database could not be loaded.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning may not continue because the UEFI database could not be loaded. This typically is caused by an improperly signed sbresources.dll. Please check the integrity of the host.

Message #

Provisioning may not continue because the UEFI database could not be loaded. This typically is caused by an improperly signed sbresources.dll. Please check the integrity of the host.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 33: Provisioning may not continue because a launch authority could not be calculated.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning may not continue because a launch authority could not be calculated.

Message #

Provisioning may not continue because a launch authority could not be calculated.

Fields #

Name	Description
`MachineID` GUID
`DataLength` UInt32
`Data` Binary

Event ID 34: Provisioning failed to extend the secure boot PCR.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning failed to extend the secure boot PCR.

Message #

Provisioning failed to extend the secure boot PCR.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 35: Provisioning failed to extend the boot lock PCR.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning failed to extend the boot lock PCR.

Message #

Provisioning failed to extend the boot lock PCR.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 36: Provisioning could not generate the server key or TPM operations.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning could not generate the server key or TPM operations.

Message #

Provisioning could not generate the server key or TPM operations.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 37: The version of communication required by Provisioning was not understood by the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The version of communication required by Provisioning was not understood by the template disk.

Message #

The version of communication required by Provisioning was not understood by the template disk.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 38: The template disk uses a version of communication not allowed by Provisioning.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template disk uses a version of communication not allowed by Provisioning.

Message #

The template disk uses a version of communication not allowed by Provisioning.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 39: Msps_ProvisioningService: Timeout detected.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Msps_ProvisioningService: Timeout detected. The remote machine appears to be unresponsive. Provisioning failed.

Message #

Msps_ProvisioningService: Timeout detected. The remote machine appears to be unresponsive. Provisioning failed.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 40: An error was provided to the provisioning service of behalf of another component: MachineGuid.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An error was provided to the provisioning service of behalf of another component: MachineGuid.

Message #

An error was provided to the provisioning service of behalf of another component: %1

Fields #

Name	Description
`MachineGuid` GUID
`Name` UnicodeString

Event ID 41: The attempt to prepare the specialized machine failed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attempt to prepare the specialized machine failed. This can occur if the utility disk provided is incorrect, or if the host encounters a terminating error while interacting with Hyper-V.

Message #

The attempt to prepare the specialized machine failed. This can occur if the utility disk provided is incorrect, or if the host encounters a terminating error while interacting with Hyper-V.

Fields #

Name	Description
`MachineID` GUID
`Win32ErrorCode` UInt32

Event ID 42: Provisioning agent reported a failure to unwrap the protected data.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning agent reported a failure to unwrap the protected data. Unable to continue.

Message #

Provisioning agent reported a failure to unwrap the protected data. Unable to continue.

Machine ID: %1
Error: %2

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 43: The target has been deemed unhealthy or not secure by attestation, provisioning will not complete.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The target has been deemed unhealthy or not secure by attestation, provisioning will not complete.

Message #

The target has been deemed unhealthy or not secure by attestation, provisioning will not complete.
  Machine ID:%1
  The status code is: %2

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 44: Due to prior health assessment operations the provisioning security process has determined that it is not safe to generate a machine key.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Due to prior health assessment operations the provisioning security process has determined that it is not safe to generate a machine key. Provisioning will not complete.

Message #

Due to prior health assessment operations the provisioning security process has determined that it is not safe to generate a machine key.  Provisioning will not complete.
  Machine ID:%1
  The status code is: %2

Fields #

Name	Description
`MachineID` GUID
`NtStatus` UInt32

Event ID 45: The provisioning service received a connection request from an unknown machine.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningHost.

Description

The provisioning service received a connection request from an unknown machine. Request will be ignored.

Message #

The provisioning service received a connection request from an unknown machine. Request will be ignored.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 46: The provisioning service received a connection request from a machine in an invalid state.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningHost.

Description

The provisioning service received a connection request from a machine in an invalid state. Request will be ignored.

Message #

The provisioning service received a connection request from a machine in an invalid state. Request will be ignored.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 47: The virtual machine cannot be shielded because its virtual disk identifier appears to be the same as the virtual disk identifier used by the shield...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Message #

The virtual machine cannot be shielded because its virtual disk identifier appears to be the same as the virtual disk identifier used by the shielding helper VHD.  This can occur when the same template disk was used to create both this virtual machine and the shielding helper VHD.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 48: The VM boot disk is a differencing disk which is not supported by the preparation process for security reasons

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The VM boot disk is a differencing disk which is not supported by the preparation process for security reasons.

Message #

The VM boot disk is a differencing disk which is not supported by the preparation process for security reasons

Fields #

Name	Description
`MachineGuid` GUID

Event ID 301: WMI call failed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

WMI call failed. Failure to execute String : MI_Result ErrorCode.

Message #

WMI call failed. Failure to execute %1 : MI_Result %2

Fields #

Name	Description
`String` AnsiString
`ErrorCode` UInt32

Event ID 301

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

WMI call failed. Failure to execute : MI_Result.

Fields #

Name	Description
`String` AnsiString
`ErrorCode` UInt32

Event ID 302: WMI call failed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

WMI call failed. Failure to execute String : Win32_Result ErrorCode.

Message #

WMI call failed. Failure to execute %1 : Win32_Result %2

Fields #

Name	Description
`String` AnsiString
`ErrorCode` UInt32

Event ID 302

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

WMI call failed. Failure to execute : Win32_Result.

Fields #

Name	Description
`String` AnsiString
`ErrorCode` UInt32

Event ID 303: Msps_ProvisioningService: Shielded VM provisioning session started.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService: Shielded VM provisioning session started.

Message #

Msps_ProvisioningService: Shielded VM provisioning session started.

Machine ID: %1

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 304: Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Message #

Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Machine ID: %1
Error: %2

Fields #

Name	Description
`MachineID` UnicodeString
`MiError` UInt32

Event ID 305: Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Message #

Msps_ProvisioningService: Failed to start Shielded VM provisioning session.

Machine ID: %1
Error: %2

Fields #

Name	Description
`MachineID` UnicodeString
`Win32Error` UInt32

Event ID 306: Msps_ProvisioningService: Shielded VM provisioning session opened.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Msps_ProvisioningService: Shielded VM provisioning session opened.

Message #

Msps_ProvisioningService: Shielded VM provisioning session opened.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 307: Msps_ProvisioningService: Shielded VM provisioning session closed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Msps_ProvisioningService: Shielded VM provisioning session closed.

Message #

Msps_ProvisioningService: Shielded VM provisioning session closed.

Machine ID: %1

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 308: Msps_ProvisioningJob removed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Msps_ProvisioningJob removed.

Message #

Msps_ProvisioningJob removed.

Instance ID %1

Fields #

Name	Description
`String` UnicodeString

Event ID 309: Msps_ProvisioningService service activated.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService service activated.

Message #

Msps_ProvisioningService service activated.

Event ID 309

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService service activated.

Event ID 310: Msps_ProvisioningService service completed.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService service completed.

Message #

Msps_ProvisioningService service completed.

Event ID 310

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningService service completed.

Event ID 311: Msps_ProvisioningJob: Received request to retrieve job.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob: Received request to retrieve job.

Message #

Msps_ProvisioningJob: Received request to retrieve job.

Machine ID / Instance ID: %1

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 311

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob: Received request to retrieve job.

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 312: Msps_ProvisioningJob: Received request to delete job.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob: Received request to delete job.

Message #

Msps_ProvisioningJob: Received request to delete job.

MachineID / Instance ID: %1

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 312

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob: Received request to delete job.

Fields #

Name	Description
`MachineID` UnicodeString

Event ID 313: Msps_ProvisioningJob found Uint instances.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob found Uint instances.

Message #

Msps_ProvisioningJob found %1 instances.

Fields #

Name	Description
`Uint` UInt32

Event ID 313

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningService.

Description

Msps_ProvisioningJob found instances.

Fields #

Name	Description
`Uint` UInt32

Event ID 400: The provisioning process logged an unknown event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning process logged an unknown event. This can happen if the template disk is from a newer operating system than the host.

Message #

The provisioning process logged an unknown event. This can happen if the template disk is from a newer operating system than the host.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID
`EventId` UInt32
`SourceId` UInt32
`EventPayloadSizeBytes` UInt32
`EventPayload` Binary

Event ID 401: The provisioning data has been received over the secure channel.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning data has been received over the secure channel.

Message #

The provisioning data has been received over the secure channel.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 402: The fabric data has been received over the secure channel.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The fabric data has been received over the secure channel.

Message #

The fabric data has been received over the secure channel.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 403: The provisioning data was successfully transferred over the secure channel.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning data was successfully transferred over the secure channel.

Message #

The provisioning data was successfully transferred over the secure channel.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 404: The secure inputs are being processed by the provisioning service.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The secure inputs are being processed by the provisioning service.

Message #

The secure inputs are being processed by the provisioning service.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 405: The VM being provisioned is communicating with the remote TPM.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The VM being provisioned is communicating with the remote TPM.

Message #

The VM being provisioned is communicating with the remote TPM.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 406: Provisioning started.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning started.

Message #

Provisioning started.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 407: The Shielded VM was successfully provisioned.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The Shielded VM was successfully provisioned.

Message #

The Shielded VM was successfully provisioned.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 408: The template manager is analyzing the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager is analyzing the template disk.

Message #

The template manager is analyzing the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 409: The template manager finished analyzing the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager finished analyzing the template disk.

Message #

The template manager finished analyzing the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 410: The template manager is sealing the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager is sealing the template disk.

Message #

The template manager is sealing the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 411: The template manager has sealed the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager has sealed the template disk.

Message #

The template manager has sealed the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 412: The specialization agent is applying the fabric data to the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The specialization agent is applying the fabric data to the template disk.

Message #

The specialization agent is applying the fabric data to the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 413: The specialization agent has finished applying the fabric data to the template disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The specialization agent has finished applying the fabric data to the template disk.

Message #

The specialization agent has finished applying the fabric data to the template disk.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 414: The provisioning agent has started executing the plugins for the Shielded VM.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent has started executing the plugins for the Shielded VM.

Message #

The provisioning agent has started executing the plugins for the Shielded VM.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 415: The provisioning agent has finished executing the plugins for the Shielded VM.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent has finished executing the plugins for the Shielded VM.

Message #

The provisioning agent has finished executing the plugins for the Shielded VM.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 416: A specialization value was replaced in the Shielded VM's unattend file.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

A specialization value was replaced in the Shielded VM's unattend file.

Message #

A specialization value was replaced in the Shielded VM's unattend file.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 417: The provisioning agent was started and is communicating with the host machine.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent was started and is communicating with the host machine.

Message #

The provisioning agent was started and is communicating with the host machine.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 418: The provisioning process was started within the Shielded VM and is communicating with the host machine.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning process was started within the Shielded VM and is communicating with the host machine.

Message #

The provisioning process was started within the Shielded VM and is communicating with the host machine.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 419: The UEFI variables were received by the provisioning process.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The UEFI variables were received by the provisioning process.

Message #

The UEFI variables were received by the provisioning process.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 420: An attestation event was received from the provisioning process.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An attestation event was received from the provisioning process.

Message #

An attestation event was received from the provisioning process.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 421: A diagnostic attestation event was received from the provisioning process.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

A diagnostic attestation event was received from the provisioning process.

Message #

A diagnostic attestation event was received from the provisioning process.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 422: No instance of Name was found in the unattend file included in the provisioning data.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

No instance of Name was found in the unattend file included in the provisioning data.

Message #

No instance of %2 was found in the unattend file included in the provisioning data.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID
`Name` AnsiString

Event ID 423: The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this Mach...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this.

Message #

The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 424: The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this Mach...

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this.

Message #

The template manager is skipping verification of the signature catalog on disk because it does not exist and the provisioning data allows this

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 425: The template manager has updated the factory policy of the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager has updated the factory policy of the provisioned VM.

Message #

The template manager has updated the factory policy of the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 426: The template manager has set the sealing values of the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager has set the sealing values of the provisioned VM.

Message #

The template manager has set the sealing values of the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 427: The provisioning agent is starting the Execute pass on the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent is starting the Execute pass on the provisioned VM.

Message #

The provisioning agent is starting the Execute pass on the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 428: The provisioning agent has finished the Execute pass on the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent has finished the Execute pass on the provisioned VM.

Message #

The provisioning agent has finished the Execute pass on the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 429: The provisioning agent has finished the platform update on the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent has finished the platform update on the provisioned VM.

Message #

The provisioning agent has finished the platform update on the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 430: The provisioning agent is starting to predict the sealing values of the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent is starting to predict the sealing values of the provisioned VM.

Message #

The provisioning agent is starting to predict the sealing values of the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 431: The provisioning agent is starting the Finalize pass on the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent is starting the Finalize pass on the provisioned VM.

Message #

The provisioning agent is starting the Finalize pass on the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 432: The provisioning agent has finished the Finalize pass on the provisioned VM Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent has finished the Finalize pass on the provisioned VM.

Message #

The provisioning agent has finished the Finalize pass on the provisioned VM

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 433: The provisioning agent is allowed to use the UEFI CA per current policy Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning agent is allowed to use the UEFI CA per current policy.

Message #

The provisioning agent is allowed to use the UEFI CA per current policy

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 434: The provisioning service is selecting a launch authority Machine ID.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The provisioning service is selecting a launch authority.

Message #

The provisioning service is selecting a launch authority

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 434

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning service is selecting a launch authority.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 435: The template disk has declared its current version for the purposes of negotiation.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template disk has declared its current version for the purposes of negotiation.

Message #

The template disk has declared its current version for the purposes of negotiation.

Fields #

Name	Description
`MachineID` GUID
`VersionNegotiationVersion` UInt8
`DeclaredVersionMajor` UInt16
`DeclaredVersionMinor` UInt16
`DeclaredVersionBuild` UInt16
`DeclaredVersionRelease` UInt16
`DeclaredVersionLogicalMajor` UInt8
`DeclaredVersionLogicalMinor` UInt8
`AcceptableVersionStartMajor` UInt8
`AcceptableVersionStartMinor` UInt8

Event ID 436: The provisioning service has accepted a communications version supported by the template disk

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning service has accepted a communications version supported by the template disk.

Message #

The provisioning service has accepted a communications version supported by the template disk

Fields #

Name	Description
`MachineID` GUID
`AcceptedVersionStartMajor` UInt8
`AcceptedVersionStartMinor` UInt8

Event ID 437: Received status update from the template manager.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

Received status update from the template manager.

Message #

Received status update from the template manager.

Machine ID: %1
Status %2
Percent %3

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32
`uint2` UInt32

Event ID 437

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Received status update from the template manager.

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32
`uint2` UInt32

Event ID 438: The template manager successfully validated the image hash.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager successfully validated the image hash.

Message #

The template manager successfully validated the image hash.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 439: The template manager completed rolling the FVEK.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager completed rolling the FVEK.

Message #

The template manager completed rolling the FVEK.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 440: The template manager successfully protected the volume.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The template manager successfully protected the volume.

Message #

The template manager successfully protected the volume.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 441: The provisioning Agent encountered an unknown data section.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The provisioning Agent encountered an unknown data section.

Message #

The provisioning Agent encountered an unknown data section.

Machine ID: %1%Destination: %2
Section ID: %3

Fields #

Name	Description
`MachineID` GUID
`PDKDestinationID` GUID
`PDKSectionID` GUID

Event ID 441

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The provisioning Agent encountered an unknown data section.

Fields #

Name	Description
`MachineID` GUID
`PDKDestinationID` GUID
`PDKSectionID` GUID

Event ID 442: An external BitLocker key was created for a template volume.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An external BitLocker key was created for a template volume.

Message #

An external BitLocker key was created for a template volume.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 443: An encrypted BitLocker external key for a template volume was written to disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An encrypted BitLocker external key for a template volume was written to disk.

Message #

An encrypted BitLocker external key for a template volume was written to disk.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 500: Ptp Session Event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

Ptp Session Event.

Message #

Ptp Session Event

Machine ID: %1
Source: %2
EventID %3

Fields #

Name	Description
`MachineID` GUID
`Source` UInt32
`DiagnosticID` UInt32
`FailureID` UInt32

Event ID 500

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Ptp Session Event.

Fields #

Name	Description
`MachineID` GUID
`Source` UInt32
`DiagnosticID` UInt32
`FailureID` UInt32

Event ID 501: Ptp Session Event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

Ptp Session Event.

Message #

Ptp Session Event

Machine ID: %1
Source: %2
EventID %3

Fields #

Name	Description
`MachineID` GUID
`Source` UInt32
`DiagnosticID` UInt32
`FailureID` UInt32

Event ID 501

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Ptp Session Event.

Fields #

Name	Description
`MachineID` GUID
`Source` UInt32
`DiagnosticID` UInt32
`FailureID` UInt32

Event ID 502: Invalid payload in error notification.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

Invalid payload in error notification.

Message #

Invalid payload in error notification.

Machine ID: %1
ErrorID: %2

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 502

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Invalid payload in error notification.

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 503: Invalid attestation payload in notification.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

Invalid attestation payload in notification.

Message #

Invalid attestation payload in notification.

Machine ID: %1%Size: %2

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 503

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Invalid attestation payload in notification.

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 504: uint attestation items received from the attestation diagnostics log.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

uint attestation items received from the attestation diagnostics log.

Message #

%2 attestation items received from the attestation diagnostics log.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 504

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

attestation items received from the attestation diagnostics log.

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 505: An attestation log item was too short to be valid (uint bytes).

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

An attestation log item was too short to be valid (uint bytes).

Message #

An attestation log item was too short to be valid (%2 bytes).

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 505

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An attestation log item was too short to be valid ( bytes).

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 506: The authoritative event log was deemed invalid.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The authoritative event log was deemed invalid.

Message #

The authoritative event log was deemed invalid.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 506

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The authoritative event log was deemed invalid.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 507: The authoritative event log is missing an event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The authoritative event log is missing an event.

Message #

The authoritative event log is missing an event.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 507

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The authoritative event log is missing an event.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 508: The attestation log is missing an event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation log is missing an event.

Message #

The attestation log is missing an event.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 508

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation log is missing an event.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 509: The data in the attestation event is incorrect.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The data in the attestation event is incorrect.

Message #

The data in the attestation event is incorrect.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 509

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The data in the attestation event is incorrect.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 510: The attestation log is invalid.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation log is invalid.

Message #

The attestation log is invalid.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 510

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation log is invalid.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 511: An unexpected attestation event was encountered.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

An unexpected attestation event was encountered.

Message #

An unexpected attestation event was encountered.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 511

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An unexpected attestation event was encountered.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 512: The attestation log contained an event which was incorrect.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation log contained an event which was incorrect.

Message #

The attestation log contained an event which was incorrect.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 512

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation log contained an event which was incorrect.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 513: The attestation event log contains an unknown event.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation event log contains an unknown event. The event ID was uint.

Message #

The attestation event log contains an unknown event. The event ID was %2.

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 513

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation event log contains an unknown event. The event ID was .

Fields #

Name	Description
`MachineID` GUID
`uint` UInt32

Event ID 514: An attestation event log item is corrupt.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

An attestation event log item is corrupt.

Message #

An attestation event log item is corrupt.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 514

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

An attestation event log item is corrupt.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 515: The name of the attestation event log item is Name.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The name of the attestation event log item is Name.

Message #

The name of the attestation event log item is %2.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID
`Name` UnicodeString

Event ID 515

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The name of the attestation event log item is .

Fields #

Name	Description
`MachineGuid` GUID
`Name` UnicodeString

Event ID 516: The attestation event log item name has no name information.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation event log item name has no name information.

Message #

The attestation event log item name has no name information.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 516

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation event log item name has no name information.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 517: The attestation event log item WCBL payload appears corrupt.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The attestation event log item WCBL payload appears corrupt.

Message #

The attestation event log item WCBL payload appears corrupt.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 517

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The attestation event log item WCBL payload appears corrupt.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 518: PCR Index: PCRIndex, Zero-based order relative to PCR: RelativeOrderToPCR, Event: Event, Length: Length.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

PCR Index: PCRIndex, Zero-based order relative to PCR: RelativeOrderToPCR, Event: Event, Length: Length.

Message #

PCR Index: %2, Zero-based order relative to PCR: %3, Event: %4, Length: %5

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`PCRIndex` UInt32
`RelativeOrderToPCR` UInt32
`Event` UInt32
`Length` UInt32

Event ID 518

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

PCR Index: , Zero-based order relative to PCR: , Event: , Length.

Fields #

Name	Description
`MachineID` GUID
`PCRIndex` UInt32
`RelativeOrderToPCR` UInt32
`Event` UInt32
`Length` UInt32

Event ID 519: The event data is too short or otherwise corrupt and does not contain a TrEE variable.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The event data is too short or otherwise corrupt and does not contain a TrEE variable.

Message #

The event data is too short or otherwise corrupt and does not contain a TrEE variable.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 519

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The event data is too short or otherwise corrupt and does not contain a TrEE variable.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 520: TrEE authoritative variable data payload found.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

TrEE authoritative variable data payload found.

Message #

TrEE authoritative variable data payload found.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Namespace` GUID
`UnicodeName` UnicodeString
`DataLength` UInt32
`Data` Binary

Event ID 520

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

TrEE authoritative variable data payload found.

Fields #

Name	Description
`MachineID` GUID
`Namespace` GUID
`UnicodeName` UnicodeString
`DataLength` UInt32
`Data` Binary

Event ID 521: TrEE attestation variable data payload found.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

TrEE attestation variable data payload found.

Message #

TrEE attestation variable data payload found.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Namespace` GUID
`UnicodeName` UnicodeString
`DataLength` UInt32
`Data` Binary

Event ID 521

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

TrEE attestation variable data payload found.

Fields #

Name	Description
`MachineID` GUID
`Namespace` GUID
`UnicodeName` UnicodeString
`DataLength` UInt32
`Data` Binary

Event ID 522: The process of converting an existing VM has started.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The process of converting an existing VM has started.

Message #

The process of converting an existing VM has started.

Machine ID: %1

Fields #

Name	Description
`MachineGuid` GUID
`Name` UnicodeString

Event ID 522

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The process of converting an existing VM has started.

Fields #

Name	Description
`MachineGuid` GUID
`Name` UnicodeString

Event ID 523: A call has failed during the conversion process.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

A call has failed during the conversion process.

Message #

A call has failed during the conversion process.

Machine ID: %1

Call site: %2

Error code:%3

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString
`Win32ErrorCode` UInt32

Event ID 523

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

A call has failed during the conversion process.

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString
`Win32ErrorCode` UInt32

Event ID 524: The temporary VM will be named Name.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The temporary VM will be named Name.

Message #

The temporary VM will be named %2.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 524

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The temporary VM will be named .

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 525: The original VM's boot disk is at Name.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The original VM's boot disk is at Name.

Message #

The original VM's boot disk is at %2.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 525

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The original VM's boot disk is at .

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 526: The temporary VM has been created with identifier Name.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The temporary VM has been created with identifier Name.

Message #

The temporary VM has been created with identifier %2.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 526

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The temporary VM has been created with identifier .

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 527: The disk at Name has been added to the temporary VM.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The disk at Name has been added to the temporary VM.

Message #

The disk at %2 has been added to the temporary VM.

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 527

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The disk at has been added to the temporary VM.

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString

Event ID 528: A KVP value has been retrieved from the temporary VM: Name / Value.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

A KVP value has been retrieved from the temporary VM: Name / Value.

Message #

A KVP value has been retrieved from the temporary VM: %2 / %3

Machine ID: %1

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString
`Value` UnicodeString

Event ID 528

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

A KVP value has been retrieved from the temporary VM: /.

Fields #

Name	Description
`MachineID` GUID
`Name` UnicodeString
`Value` UnicodeString

Event ID 529: The target UEFI db variable does not match the expected value and adoption is blocked by policy.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The target UEFI db variable does not match the expected value and adoption is blocked by policy. Provisioning may fail.

Message #

The target UEFI db variable does not match the expected value and adoption is blocked by policy.  Provisioning may fail.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 530: The target UEFI dbx variable does not match the expected value and adoption is blocked by policy.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The target UEFI dbx variable does not match the expected value and adoption is blocked by policy. Provisioning may fail.

Message #

The target UEFI dbx variable does not match the expected value and adoption is blocked by policy.  Provisioning may fail.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 531: Provisioning is unable to verify the Provisioning Agent stack version in the target.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

Provisioning is unable to verify the Provisioning Agent stack version in the target. Provisioning may fail.

Message #

Provisioning is unable to verify the Provisioning Agent stack version in the target.  Provisioning may fail.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 532: The grandfathering utility disk and the boot disk of the original VM appear to be unique.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The grandfathering utility disk and the boot disk of the original VM appear to be unique.

Message #

The grandfathering utility disk and the boot disk of the original VM appear to be unique.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 532

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The grandfathering utility disk and the boot disk of the original VM appear to be unique.

Fields #

Name	Description
`MachineGuid` GUID

Event ID 533: The VM boot disk is not a differencing disk.

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Debug
Task: ShieldedVMProvisioningSession.

Description

The VM boot disk is not a differencing disk.

Message #

The VM boot disk is not a differencing disk.
  Machine ID:%1

Fields #

Name	Description
`MachineGuid` GUID

Event ID 533

Provider: Microsoft-Windows-ShieldedVM-ProvisioningService
Channel: Operational
Task: ShieldedVMProvisioningSession.

Description

The VM boot disk is not a differencing disk.

Fields #

Name	Description
`MachineGuid` GUID

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)