Question I'm having issues with Security-SPP source (Software Protection) ?

[youpull]

CPU: Intel(R) Core(TM) i7-10700K
Motherboard: ASUS ROG STRIX Z490-E GAMING
Ram: Kingston KF3600C18D4/16GX x 2
SSD/HDD: Samsung SSD 860 EVO 1 TB, Kingston SV200S3128G, WDC WD20EZBX-22AYRA0
GPU: Nvidia Geforce GTX 1060 6GB
OS: Windows 10 Home Version 22H2
BIOS version: 0403

Context about the issue: I'm a very casual PC user and during gaming or even sometimes while just watching videos my computer would freeze or do some sort of "spasm" where it would replay a certain sound and/or image for 1-2 seconds. Now this isnt that big of an issue but if it happens multiple times a day and for at least a month it does become quite annoying.

Troubleshooting steps I've tried:

• I first thought this was RAM issue so I bought new ram sticks, didnt help.
• Then I tried repairing my drives with the windows commands (both my hard drive which I have my games and other documents on, and my SSD which I have the OS on), this didnt help solve the issue either.
• Then I checked the event viewer and saw that the source Security-SPP at random times (but coinciding with when I would get issue) would spam the event viewer with Event ID 16394 and 16384. For additional context, the description of these 2 events are the following: Offline downlevel migration succeeded. and Successfully scheduled Software Protection service for re-start at 2124-01-15T09:24:09Z. Reason: RulesEngine.

After this I felt like I narrowed down the cause of my issue so I tried searching for potential fixes to this specific issue. So far I've tried disabling Windows Firewall, restarting the Software Protection service, disabling the Software Protection Service in the Registry Editor (the value got reset when I restarted my PC so it didn't even work), disabling the start of the Software Protection Service in Task Scheduler, reinstalling Windows, updating drivers, updating Windows, and none of these seem to have worked.
If anyone has any recommendations on how to further approach this issue I'd be eternally grateful.

 

[Colif]

. So far I've tried disabling Windows Firewall, restarting the Software Protection service, disabling the Software Protection Service in the Registry Editor (the value got reset when I restarted my PC so it didn't even work), disabling the start of the Software Protection Service in Task Scheduler, reinstalling Windows, updating drivers, updating Windows, and none of these seem to have worked.

have you reversed all of this? The last 3 steps probably did.

At least they fixed the year, at one stage the events were showing as 2117

The Microsoft-Windows-Security-SPP component resets licensing values that were set during system installation and image testing. It restores the computer to a clean-install licensing state.

https://learn.microsoft.com/en-us/w...sktop/unattend/microsoft-windows-security-spp

16384 is normal - https://kb.eventtracker.com/evtpass/evtpages/EventId_16384_Microsoft-Windows-Bits-Client_66937.asp
16394 isn't so normal. I don't want you to do any of this - https://kb.eventtracker.com/evtpass/evtPages/EventId_16394_SAM_67535.asp

see if this helps
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

So have you tested the 3 drives with software made by their makers?
Samsung - https://semiconductor.samsung.com/consumer-storage/support/tools/
Kingston - https://www.kingston.com/en/support/technical/ssdmanager
Western Digital - https://support-en.wd.com/app/answe...ive-and-update-firmware-using-western-digital

 

[youpull]

have you reversed all of this? The last 3 steps probably did.

I did the steps almost exactly in the same order I wrote it, albeit I did try updating drivers and windows before I re-installed it and then updated them again after wiping my windows with the factory reset or whatever option within Windows. Windows got practically re-installed with that and obviously I can't reverse that and I haven't changed my drivers since trying to update them to the latest version after re-installing/resetting windows.

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

This gave me the following results:

So I restarted my system as advised.

The same occurred. What's interesting is that looking at my events from yesterday these event ids popped up exactly in half an hour intervals. This is also the case after I restarted, with the one exception being the set at 20:52:08 shown in the image.

So have you tested the 3 drives with software made by their makers?
Samsung - https://semiconductor.samsung.com/consumer-storage/support/tools/
Kingston - https://www.kingston.com/en/support/technical/ssdmanager
Western Digital - https://support-en.wd.com/app/answe...ive-and-update-firmware-using-western-digital

I tested the drives upon reading this. The samsung software showed that I'm on the latest version of the firmware. The WD software showed that my HDD cant get a firmware update within the software (apparently this is the case for newer HDDs produced by WD according to a google search) and my Kingston drive did not show up at all within the software in the firmware/operations/health or security tab, but it did get recognized within the events tab in the software. Apparently this happens when the drive is an OEM drive which is supposed to come with a pre-built setup according to another google search.

 

[Colif]

Are you certain the events are happening at same time as the spasm?
if it survived a clean install it could be a hardware cause instead.

its why I got you to check drives - did you run diagnostics on the samsung drive in magician?
do you have newest bios on motherboard? How did you get latest drivers?

 

[youpull]

Are you certain the events are happening at same time as the spasm?
if it survived a clean install it could be a hardware cause instead.

Yea the spasm is certainly related sadly. I confirmed yesterday that when event 16394 happened is when I got the issue (I wanna point out it doesnt happen with each instance of event 16394, only with some of them). I did see gpu driver updates solving this issue for someone else while googling, but considering my gpu has the latest drivers from geforce experience i dont think its a driver issue, but it is a pretty old gpu so it might be malfunctioning.

its why I got you to check drives - did you run diagnostics on the samsung drive in magician?

I didn't run one initially since this samsung ssd is fairly new (but I did run one now that you mentioned it I'll post the results below), if I remember correctly its at most 2 years old. Same with my HDD (less than a year old if I remember correctly). My smaller Kingston SSD however is fairly old so that could also be causing issues, I don't really use that for anything at the moment so I was thinking of trying to unplug it and see if that changes anything over the course of either today or tomorrow.

I also ran a disk check before I re-installed windows and that didn't solve my issue either.

do you have newest bios on motherboard?

I'm quite inexperienced in working with the bios so I don't think so. I have not touched anything since I got my motherboard (which would be around 3-4 years ago).

How did you get latest drivers?

I used geforce experience for my gpu and ROG Armoury Crate for a few others. What's interesting is that I did download Armoury Crate as soon as I reset my windows and let it install all the drivers it could see, yet it still shows that I have missing drivers somehow. I'm going to let it install the drivers in the image below and see if that changes anything and then reply to my post (I would've normally done this before I post so there's one comprehensive post, but I thought there's no way my armoury crate didnt do what it was supposed to).

 

[Colif]

its worth a try, Management engine talks to CPU.

I thought it might be lan drivers but you seem to be on newer versions than it has.

BIOS update could fix it but we see if drivers do first.

 

[youpull]

its worth a try, Management engine talks to CPU.

I thought it might be lan drivers but you seem to be on newer versions than it has.

BIOS update could fix it but we see if drivers do first.

Just restarted my PC after updating drivers at 14:38 and sadly as shown in the image I already got the 16394 event twice so I don't think the issue has been resolved yet (although I can't confirm for sure since the spasm only happens with some instances of the event).

 

[Colif]

those two events both tie into system restore, you could just turn it off

Suppress Event ID logs 16384, 16394 in Registry

These two logs in Event Viewer ->Applications come out in pairs most times. These have been coming out for a long time, both before and after I had to replace the SSD and did a new install of Win11 22h2. I have been for a long time now just suppressing them in the Event Viewer and since...

www.elevenforum.com

it creates a system restore point everytime you install new drivers, so it would have been busy recently. Maybe stop installing things and see if it calms down.

Still seems strange.
if it is system restore, spasm must be one of your drives.

can you right click start
choose disk management
expand both the top and bottom part of next window.
take a screenshot and show here... just curious which drive pc is running off.

 

[youpull]

those two events both tie into system restore, you could just turn it off

Suppress Event ID logs 16384, 16394 in Registry

These two logs in Event Viewer ->Applications come out in pairs most times. These have been coming out for a long time, both before and after I had to replace the SSD and did a new install of Win11 22h2. I have been for a long time now just suppressing them in the Event Viewer and since...

www.elevenforum.com

it creates a system restore point everytime you install new drivers, so it would have been busy recently. Maybe stop installing things and see if it calms down.

Still seems strange.
if it is system restore, spasm must be one of your drives.

can you right click start
choose disk management
expand both the top and bottom part of next window.
take a screenshot and show here... just curious which drive pc is running off.

For some context, I had my fair share of replacing drives in this PC so my OS used to be on Disk 1 (the Kingston SSD) and the D: partition is called Reserved for system (or something along those lines in Hungarian). The OS is currently on Disk 0 (Samsung SSD) as can be seen, and I had to I think remake or expand or do something with the Recovery Partition to be able to update to one of the latest Windows updates. I dont necessarily think this has any connection with the issue since it was happening even before I tried to update, but just wanted to put out there (https://support.microsoft.com/en-us...e-update-400faa27-9343-461c-ada9-24c8229763bf this is what I did). How should I proceed further? Try turning off System Restore or updating BIOS? I have a hard time believing (and also would be very sad) if any of my drives other than Disk 2 (the Kingston SSD) would be faulty, considering they are fairly new.

 

[youpull]

As an update to this I tried disabling the system restore and even that didnt stop the problem somehow.