I have just noticed on the Application event logs very frequent checks (some time 10+ checks in the same minute) every two minutes for the last 2 months. Is there a reason for the checks? extract of the event XML. <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" /> <EventID Qualifiers="16384">1003</EventID> ...

Hi Luis, Have you activated your Windows and Office? Please verify. Do you encounter any problem when running the system? Tim Quan

Looks like I just asked the same question, did you ever get an answer?Chris Spann, Geek

I'm running Server 2008 R2 Enterprise and my log is full of Security-SPP checks. I don't have office installed and I have activated using my MSDN key. Everything is normal except users are having random problems connecting via mstsc. Sometimes it works, sometimes it doesn't.

I'm getting thousands of these Informational messages in my event log in Windows 2008 R2 Standard Core. Here are the last 3 events which have occured Event[0]: Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 2010-12-09T10:48:27.000 Event ID: 1003 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Removed.for.Security Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: f14c8ee3-560d-441e-aee1-325c2e9ae74a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Event[1]: Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 2010-12-09T10:48:27.000 Event ID: 1003 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Removed.for.Security Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: da71774d-b2c9-4c42-bb7b-a66365d5abb2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Event[2]: Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 2010-12-09T10:48:27.000 Event ID: 1003 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Removed.for.Security Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Accoding to slmgr.vbs, my license status is currently licensed. Microsoft (R) Windows Script Host Version 5.8 Copyright (C) Microsoft Corporation. All rights reserved. Name: Windows Server(R), ServerStandardCore edition Description: Windows Operating System - Windows Server(R), VOLUME_KMSCLIENT channel Partial Product Key: Removed License Status: Licensed Volume activation expiration: 250920 minute(s) (174 day(s)) Key Management Service client information Client Machine ID (CMID): 1f75aebc-ba57-4554-b7a3-b0a8834ec916 KMS machine name from DNS: removed.for.security:1688 KMS machine extended PID: 55041-00168-305-246209-03-1033-7600.0000-0522010 Activation interval: 120 minutes Renewal interval: 10080 minutes KMS host caching is enabled I have just tried doing an activation, which it claims to have been successful PS C:\Windows\System32> cscript slmgr.vbs /ato Microsoft (R) Windows Script Host Version 5.8 Copyright (C) Microsoft Corporation. All rights reserved. Activating Windows Server(R), ServerStandardCore edition (68531fb9-5511-4989-97be-d11a0f55633f) ... Product activated successfully. Yet, the events still continue. They occur every 2 minutes, and there are usually 11 events with different "Licensing Status" every cycle. I have the following roles installed [X] File Services [X] File Server [X] Distributed File System [X] DFS Namespaces [X] DFS Replication [X] Print and Document Services [X] Print Server [X] .NET Framework 3.5.1 Features [X] .NET Framework 3.5.1 [X] Telnet Client [X] Windows Server Backup Features [X] Windows Server Backup [X] WoW64 Support [X] WoW64 There is no other software installed on this server. Any idea why this server is generating so many of these events? There has been 40,421 events in 9 days.

Exactly the same, same Application-ID. Mine refers to System32\wucltux.dll which does not appear to exist on my copy of Server Core, and is not mentioned anywhere else in the registry except where it appears in the SoftwareProtectionPlatform key. wucltux.dll is apparently (part of) the Windows Update Client User Experience functions. Not sure if that's even available on Server Core?

Same situation here, Windows Server 2008 R2 EE Core. 8 Events EVERY 2 minutes. File Server, running FSRM, Print Managment, PowerShell, .Net 2.0, BPA, thats it. KMS activated. 1) --------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: ea36520d-fbfe-4042-acd8-fe926781b615, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2) --------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3) --------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: c74dc7f6-ea35-4bd7-9776-333ab5dddae6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4) --------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: b297426d-464d-4af1-abb2-3474aeecb878, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5) ---------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 8fe15d04-fc66-40e6-bf34-942481e06fd8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6) ----------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7) ----------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 620e2b3d-09e7-42fd-802a-17a13652fe7a, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 244800)(?)(?)(?)])(1 )(2 )] 8) ------------------- The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 4bcc8879-e699-4159-a810-f829566662ca, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] ----------------------- Every 2 minutes Really troubles me that there has been no explanation posted nor clearly a fix required. Either manual or hotfix. It completey takes over the "application" log and the proc never rests (not peg'ed but being used).

My original issue vanished (only did a restart), but now it started again, about 4 to 5 checks per minute. Exactly this guy here: wucltux.dll

I am getting these too. Running Server 2008 R2 core and am getting 2 or 3 a second!! The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] So same GUID as all the above

Did anyone find an answer for evet id 1003 Source Security-SPP? Why it is filling up application logs?Raman

This is happening to me too in Hyper-V Server 2008 R2, and this OS can't be activated freely. Cheers, Akuma.

Is anyone running server manager remotely? That's what was causing mine. Every time I ran server manager to remotely manage my 3 servers all three systems started logging Secuity-SPP Event ID 1003. Rob