Microsoft-Windows-SmartCard-TPM-VCard-Module

Event	Title	Channel	Sample	Rule
1101	TPM Virtual Smart Card failed to verify TPM state.	Admin	N	N
1102	TPM Virtual Smart Card failed to verify TPM state.	Admin	N	N
1103	TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout …	Admin	N	N
1104	TPM Virtual Smart Card failed to verify TPM state.	Admin	N	N
2101	TPM Virtual Smart Card is loading.	Operational	N	N
2102	TPM Virtual Smart Card has been loaded.	Operational	N	N
2103	TPM Virtual Smart Card cannot be loaded with error: WinError.	Operational	N	N
2104	TPM Virtual Smart Card is verifying TPM state.	Operational	N	N
2105	TPM Virtual Smart Card has successfully verified TPM state.	Operational	N	N
2106	TPM Virtual Smart Card is closing.	Operational	N	N
2107	TPM Virtual Smart Card has been closed.	Operational	N	N

Event ID 1101: TPM Virtual Smart Card failed to verify TPM state.

Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. TPM is not ready for this TPM Virtual Smart Card.

Message #

TPM Virtual Smart Card failed to verify TPM state. TPM is not ready for this TPM Virtual Smart Card.

Card root path: %1
TPM verification failed with error: %2

Fields #

Name	Description
`Path` UnicodeString
`WinError` UInt32

Event ID 1102: TPM Virtual Smart Card failed to verify TPM state.

Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. Some of the TPM keys are missing. If the ownership of the TPM is recently changed, all previously created TPM Virtual Smart Cards will be invalidated. Card root path: Path

Message #

TPM Virtual Smart Card failed to verify TPM state. Some of the TPM keys are missing. If the ownership of the TPM is recently changed, all previously created TPM Virtual Smart Cards will be invalidated.

 Card root path: %1

Fields #

Name	Description
`Path` UnicodeString

Event ID 1103: TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Channel: Admin

Message #

TPM Virtual Smart Card cannot verify TPM state since the TPM is in lockout state.

Card root path: %1

Fields #

Name	Description
`Path` UnicodeString

Event ID 1104: TPM Virtual Smart Card failed to verify TPM state.

Channel: Admin

Description

TPM Virtual Smart Card failed to verify TPM state. The Trusted Platform Module (TPM) firmware on this PC has a known security problem. Please contact your PC manufacturer to find out if an update is available.

Message #

TPM Virtual Smart Card failed to verify TPM state. The Trusted Platform Module (TPM) firmware on this PC has a known security problem. Please contact your PC manufacturer to find out if an update is available.

Fields #

Name	Description
`WinError` UInt32

Event ID 2101: TPM Virtual Smart Card is loading.

Channel: Operational

Message #

TPM Virtual Smart Card is loading.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2102: TPM Virtual Smart Card has been loaded.

Channel: Operational

Message #

TPM Virtual Smart Card has been loaded.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2103: TPM Virtual Smart Card cannot be loaded with error: WinError.

Channel: Operational

Message #

TPM Virtual Smart Card cannot be loaded with error: %2

Context: %1

Fields #

Name	Description
`Context` Pointer
`WinError` UInt32

Event ID 2104: TPM Virtual Smart Card is verifying TPM state.

Channel: Operational

Message #

TPM Virtual Smart Card is verifying TPM state.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2105: TPM Virtual Smart Card has successfully verified TPM state.

Channel: Operational

Message #

TPM Virtual Smart Card has successfully verified TPM state.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2106: TPM Virtual Smart Card is closing.

Channel: Operational

Message #

TPM Virtual Smart Card is closing.

Context: %1

Fields #

Name	Description
`Context` Pointer

Event ID 2107: TPM Virtual Smart Card has been closed.

Channel: Operational

Message #

TPM Virtual Smart Card has been closed.

Context: %1

Fields #

Name	Description
`Context` Pointer

Provenance

ETW provider GUID 125f2cf1-2768-4d33-976e-527137d080f8

Defined in tpmvsc.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB