The log shows the following events almost exactly every 5 minutes on a WS 2008 R2: The Software Protection service has stopped.The Software Protection service is starting.Initialization status for service objects....The Software Protection service has completed licensing status check....The Software Protection service has started. These five events are within 2 seconds. Could anyone shed some light on what is going on? Thanks in advance. Hong

I too am experiencing the service stopping and starting repeatedly. I've also noticed that the server has periodically become unresponsive for a few seconds at a time. The server is running VMware VirtualCenter and is under a very low load as far as CPU, Memory and Network.

Hi, It shouldn't be running every five minutes unless something is wrong with the licencing status or you have a monitoring/management tool checking the licencing status of the server, which will require the service to start. You can double-check the frequency of the scheduled task that usually handles the starting of the service within the Scheduled Tasks MMC here: Task Scheduler Library\Microsoft\Windows\SoftwareProtectionPlatform If the value for "Last Run Time" isn't correlating with the timestamps you're seeing on the event log entries, then you've got a monitoring/management process tripping the service. Cheers, Lain

Thanks a lot for the elucidation. The "Last Run Time" is "Never". The status is "Disabled". It stopped this morning after it lasted for about 27 hours. Hong

I'm not sure what to make of the service resheculding task being disabled, but it sounds like some part of the initial licensing routine hasn't completed successfully. Are you actually using KMS infrastructure, or are you simply MAK-activating your servers? What is the output from running the following command on the server in question? cscript c:\windows\system32\slmgr.vbs /dli Cheers, Lain

Hi Lain, The output is: C:\Users\Administrator>cscript c:\windows\system32\slmgr.vbs /dliMicrosoft (R) Windows Script Host Version 5.8Copyright (C) Microsoft Corporation. All rights reserved.Name: Windows Server(R), ServerEnterprise editionDescription: Windows Operating System - Windows Server(R), VOLUME_MAK_B channelPartial Product Key: BBMBMLicense Status: LicensedHong

Okay, that probably explains why the scheduled task is disabled then, as there's no recurrent checks once a MAK key has been initially activated. That still leaves your original problem, of course. What are the actual event IDs that are being generated? (They should still be from the Security-SPP source) I'll have to go away with those event IDs and see how they bear relevance to MAK activations, as we only use a KMS infrastructure here, and I'd expect to see some differences in the generated events given the 12288 and 12289 that we get only relate to KMS (as far as I understand it). Cheers, Lain

It seems the reply I posted yesterday did not go through. At least, I am not seeing it. Anyways, let me repost events with their ID's: The Software Protection service has stopped. 903The Software Protection service is starting. 900 Initialization status for service objects.... 1066The Software Protection service has completed licensing status check.... 1003The Software Protection service has started. 902 Hong

Hi, So, I've done a little reading but I don't have anything definitive. What are I do have are two links and some speculation. First, the links: Technet forum post about the same topicTechnet post with Microsoft employee feedback For the first post, I took the easy path and run Server Manager locally thinking it'd use the same behaviour and trigger the events, but it didn't. I made sure I had the Refresh option (down the bottom of Server Manager) enabled, but it made no difference. Running it remotely did yield quite a different result. Not only does it generate the events, and does so according to the refresh interval, it handles the licence checks differently. Whereas the "normal" on-host process seems to handle the licence checks in bulk, logging a single 1003 event as a result, Server Manager - when run remotely, actually handles each licence check "individually" (I don't know the actual SPP API well enough to be detailed about it) which results in a 1003 event for each and every licence type check. Anyhow, once I closed Server Manager on the remote host the events also stopped. I wouldn't class any of this as absolute proof of cause, but it at least fits into my expectation that it was something outside of the service's normal operation from my original post, which also corresponds to the second article referenced above, so I'm happy enough to accept that. Of course, this doesn't mean it's Server Manager in your case, but it does seem to point to something that is in fact talking to the Software Protection service on that machine. Cheers, Lain

Thanks a lot for the investigation. After reading your post, I checked my server and found it is happening again with the same interval - 5 minutes. The server runs SQL server and websites. No application is open. The server is managed remotely via RDP. According to the first post, it seems to be fairly common. Should we take it as a bug of WS? Puzzling! Hong

You couldn't really describe it as a bug since the SPP service is only doing what it should, which is logging requests that are being made to it. The real task you have is to identify what the calling task is and then determine if there's a reason it's checking the licencing status so often and potentially lessening those checks. Going back to the previous post as an example, if it's Server Manager, then you can actually configure the refresh interval or turn it off entirely (you'd have to tell the people running it to do this as there's no central way of doing so as far as I know). One thing you can do purely as a testing mechanic is to disable the firewall rules for "Windows Remote Management" (there's two of them: port 5985 and port 80). If you do this, then keep an eye on the event log and see if that stops the licensing events from generating. Just don't forget to re-enable the firewall rule once you're done. Cheers, Lain