Windows 10: Security-SPP event ID 16384/16394

Since updating to 24h2 on Dec 6 ive noticed my event log is constantly spammed all day long by the following two events:16384: Successfully scheduled Software Protection service for re-start at 2125-01-12T22:38:50Z. Reason: RulesEngine.16394: Offline downlevel migration succeeded.I have run all the usual windows file checkers etc and saw online to make sure network service has read permission to software protection program which it does. I keep windows and drivers all uptodate.Please advise. While i dont belive its casuing any de

:)

 

Event ID 16394 and 16384 getting spammed repeatedly in Event Viewer causing micro freezes.

Hi, Youpull

Welcome to Microsoft Community.

I'm sorry I'm late. I failed to describe this clearly in the previous scenario, for which I apologise.

Event Viewer needs to combine processes in Task Manager to see which programs are using Event ID 16384 and ID 16394. Specifically you can see if there are any anomalies in these programs by right clicking on the taskbar>Task Manager>Processes>View Programs with PIDs 16384 and 16394.

Sincerely

Nicholas | Microsoft Community Support Specialist

 

Event viewer Event ID 16384,Security-SPP

I experienced similar problem (Event ID 16384 in Windows Log/Application) Windows 11 Geekom A7 seemed to automatically shut itself down.

I looked for This PC -> C drive -> Windows but found no "minidump" folder.

 

Security SPP and Time-Service events

Hello,

I have noticed today those inforamtion in the event logs that concerns me :

Event 16394, Security SPP - migration on the lower level in offline mode was preformed successfully

Event 16384, Security SPP - scheduled a restart of application protection service at 2120-07-05T16:36:02Z Reason : Rules Engine

They occured yesterday while i was away from my switched on computer. I notice those events today as well though.

I also noticed that while being away Time-Service did the following :

158 - The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior
for the current provider in the current operating environment as well.

37 - The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123).

Could the above events be resposnbile for switching off my Zone Alarm firewall(noticed by WINDOWS 10) and for fiding a new Network(but with the same details) by Avast Antivir?

Thanks for answer in advance