| Microsoft-Windows-Security-SPP/Software Protection Service | 1000 | Info | Software Protection Service (sppsvc) started successfully |
| Microsoft-Windows-Security-SPP/Software Protection Service | 1001 | Medium | Software Protection Service stopped |
| Microsoft-Windows-Security-SPP/Software Protection Service | 1002 | High | Failed to start sppsvc due to missing license files |
| System | 7031 | High | Software Protection Service terminated unexpectedly |
| Microsoft-Windows-Security-SPP/Software Protection Service | 1020 | Info | Activation configuration file updated |
| Security | 4624 | Info | Successful logon by KMS host or AD-based activation account |
| Security | 4625 | High | Failed logon attempt to KMS host |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12288 | Info | Client activation request received |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12289 | High | KMS request denied due to invalid client key |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12290 | Critical | Unauthorized activation attempt detected |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8200 | Info | KMS host registered and listening on port 1688 |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8201 | Info | KMS client successfully activated |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8202 | High | KMS client activation failed (network or DNS issue) |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8203 | Info | Volume license token generated successfully |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8204 | Medium | KMS host count below activation threshold |
| Microsoft-Windows-Security-SPP/Software Protection Service | 1024 | Medium | Network communication failure with activation server |
| Microsoft-Windows-Security-SPP/Software Protection Service | 1025 | Medium | KMS response timeout detected |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12291 | High | License service performance degraded |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12292 | Critical | Activation database corrupted or inaccessible |
| Microsoft-Windows-Security-SPP/Software Protection Service | 12293 | Info | Hardware change detected; revalidation required |
| Security | 4719 | High | System audit policy modified (Activation Logs) |
| Security | 4732 | High | User added to Software Protection Administrators group |
| Security | 4733 | Info | User removed from Software Protection Administrators group |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8205 | High | Licensing data file modified |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8206 | Critical | Unrecognized product key added |
| Microsoft-Windows-Security-SPP/Software Protection Service | 8207 | High | Grace period expired — unlicensed mode |
| Security-SPP | 12290 | High | Licensing validation failed |
| Security-SPP | 12293 | Critical | Activation attempt failed |
| Security-SPP | 12297 | High | Activation server not reachable |
| Security-SPP | 12308 | High | ADBA key invalid or expired |
| Application | 8200 | Critical | KMS host service stopped |
| Application | 8201 | Info | KMS host service started |