Microsoft-Windows-TBS

Event	Title	Channel	Sample	Rule
516	An error occurred while communicating with the TPM.	System	N	N
521	The RPC subsystem could not be initialized.	System	N	N
538	A compatible TPM is not found.	System	N	N
16385	An internal TBS error was detected.	System	N	N
16386	An error occurred while TBS was processing power management event.	System	N	N
16392	An error occurred while starting the TBS.	System	N	N

Event ID 516: An error occurred while communicating with the TPM.

Channel: System

Description

An error occurred while communicating with the TPM. The driver returned {ErrorCode}.

Message #

An error occurred while communicating with the TPM.  The driver returned {ErrorCode}.

Fields #

Name	Description
`ErrorCode`

Event ID 521: The RPC subsystem could not be initialized.

Channel: System

Description

The RPC subsystem could not be initialized. The error returned was {ErrorCode}.

Message #

The RPC subsystem could not be initialized.  The error returned was {ErrorCode}.

Fields #

Name	Description
`ErrorCode`

Event ID 538: A compatible TPM is not found.

Channel: System

Description

A compatible TPM is not found. TBS requires TPM version {RequiredVersion} or greater; but the version of the TPM on the computer is {ActualVersion}.

Message #

A compatible TPM is not found.  TBS requires TPM version {RequiredVersion} or greater; but the version of the TPM on the computer is {ActualVersion}.

Fields #

Name	Description
`RequiredVersion`
`ActualVersion`

Event ID 16385: An internal TBS error was detected.

Channel: System

Description

An internal TBS error was detected. The error code was {ErrorCode}. This is usually caused by unexpected TPM or driver behavior and may be transient.

Message #

An internal TBS error was detected.  The error code was {ErrorCode}.  This is usually caused by unexpected TPM or driver behavior and may be transient.

Fields #

Name	Description
`ErrorCode`

Event ID 16386: An error occurred while TBS was processing power management event.

Channel: System

Description

An error occurred while TBS was processing power management event. The power management event was {EventType}; and the error code was {ErrorCode}.

Message #

An error occurred while TBS was processing power management event.  The power management event was {EventType}; and the error code was {ErrorCode}.

Fields #

Name	Description
`EventType`
`ErrorCode`

Event ID 16392: An error occurred while starting the TBS.

Channel: System

Description

An error occurred while starting the TBS. The error code was {ErrorCode}.

Message #

An error occurred while starting the TBS.  The error code was {ErrorCode}.

Fields #

Name	Description
`ErrorCode`