Edit

Event ID 8208, 8200, or 900 is logged

  • Article

This article provides a resolution for Event ID 8208, 8200, or 900.

Applies to:   Windows Server 2012 R2
Original KB number:   2958281

Symptoms

You see one or more of the following event IDs logged in the Application log:

Source: Microsoft-Windows-Security-SPP
Date: <DateTime>
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Server1.contoso.com
Description:
The Software Protection service is starting.
Parameters:caller=wsqmcons.exe

Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: <DateTime>
Event ID: 900
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Server1.contoso.com
Description:
The Software Protection service is starting.
Parameters:caller=WSHost.exe

Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: <DateTime>
Event ID: 8200
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.contoso.com
Description:
License acquisition failure details.
hr=0x80072EE7

Log Name: Application
Source: Microsoft-Windows-Security-SPP
Date: <DateTime>
Event ID: 8208
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.contoso.com
Description:
Acquisition of genuine ticket failed (hr=0x80072EE7) for template Id {99d92734-d682-4d71-983e-d6ec3f16059f}

Note

The 0x80072EE7 error code indicates that the system did not have appropriate Internet access to be able to obtain the Windows Genuine Advantage ticket.

Cause

These event IDs may be logged if an application or component in Windows tries to validate and call the Genuine Advantage APIs to acquire a Windows Genuine Advantage ticket if one does not exist. For example, these event IDs may be logged in the following situations:

  • You opt in to the Customer Experience Improvement Program (CEIP). (Caller=wsqmcons.exe)
  • You install the Desktop Experience feature, which then installs the Microsoft Store. (Caller=wshost.exe)

Note

When you try to access the Microsoft Store, this triggers a request for a Windows Genuine Advantage ticket and an attempt to acquire one through validation.

Resolution

The events that are mentioned in the "Symptoms" section are logged if the system does not have access to the Internet. To prevent these events from occurring, connect the system to the Internet, and then check the firewall and proxy settings.

If you cannot connect the system to the Internet, you can try the following methods to prevent Event ID 900, depending on the caller program identity:

  • If Caller=wsqmcons.exe, open Server Manager, and then clear the Participating check box to opt out of CEIP.
  • If Caller=wshost.exe, disable the Microsoft Store application by enabling the Computer Configuration\Administrative Templates\Windows Components\Store\Turn off the Store application policy in either the local or domain Group Policy.

Note

The inability to obtain a Windows Genuine Advantage ticket may not prevent the component from working. The presence of these event IDs does not mean that the computer is not genuine or that a licensing issue exists.

More information

The Genuine Advantage feature is designed for client operating systems and is typically not found on a server. However, it is possible for a Windows component to use the Windows Genuine Advantage APIs if it has to.

For more information about volume activation, see the following Microsoft TechNet topic:

Volume Activation Overview

For more information about Windows Genuine Advantage, see the following Windows article:

Genuine Windows: frequently asked questions

Data collection

If you need assistance from Microsoft support, we recommend you collect the information by following the steps mentioned in Gather information by using TSS for deployment-related issues.