Client Event Logs
Gjelder for: Microsoft BitLocker Administration and Monitoring 2.5
The following table contains event IDs that can occur on the MBAM Client.
| Event ID | Source | Event symbol | Message |
|---|---|---|---|
1 |
Microsoft-Windows-MBAM/Operational |
VolumeEnactmentSuccessful |
The MBAM policies were applied successfully. |
2 |
Microsoft-Windows-MBAM/Admin |
VolumeEnactmentFailed |
An error occurred while applying MBAM policies. |
3 |
Microsoft-Windows-MBAM/Operational |
TransferStatusDataSuccessful |
The encryption status data was sent successfully. |
4 |
Microsoft-Windows-MBAM/Admin |
TransferStatusDataFailed |
An error occurred while sending encryption status data. |
5 |
Microsoft-Windows-MBAM/Operational |
DriveMounted |
An error occurred while sending encryption status data. |
6 |
Microsoft-Windows-MBAM/Operational |
DriveDismounted |
A drive was unmounted. |
7 |
Microsoft-Windows-MBAM/Operational |
VolumeUnlocked |
A volume has been unlocked. |
8 |
Microsoft-Windows-MBAM/Admin |
SystemVolumeNotFound |
The system volume is missing. SystemVolume is needed to encrypt the operating system drive. |
9 |
Microsoft-Windows-MBAM/Admin |
TPMNotFound |
The TPM hardware is missing. TPM is needed to encrypt the operating system drive with any TPM protector. |
10 |
Microsoft-Windows-MBAM/Admin |
MachineHWExempted |
The computer is exempted from Encryption. Additional Information: This hardware type is exempt from the requirement to encrypt. |
11 |
Microsoft-Windows-MBAM/Admin |
MachineHWUnknown |
The computer is exempted from encryption. Additional Information: The hardware type is unknown. |
12 |
Microsoft-Windows-MBAM/Admin |
HWCheckFailed |
Hardware exemption check failed. |
13 |
Microsoft-Windows-MBAM/Admin |
UserIsExempted |
The user is exempt from encryption. |
14 |
Microsoft-Windows-MBAM/Admin |
UserIsWaiting |
The user requested an exemption. |
15 |
Microsoft-Windows-MBAM/Admin |
UserExemptionCheckFailed |
User exemption check failed. |
16 |
Microsoft-Windows-MBAM/Admin |
UserPostponed |
The user postponed the encryption process. |
17 |
Microsoft-Windows-MBAM/Admin |
TPMInitializationFailed |
TPM initialization failed. The user rejected the BIOS changes. |
18 |
Microsoft-Windows-MBAM/Admin |
CoreServiceDown |
Unable to connect to the MBAM Recovery and Hardware service. |
19 |
Microsoft-Windows-MBAM/Operational |
CoreServiceUp |
Successfully connected to the MBAM Recovery and Hardware service. |
20 |
Microsoft-Windows-MBAM/Admin |
PolicyMismatch |
The MBAM policy is in conflict or corrupt. |
21 |
Microsoft-Windows-MBAM/Admin |
ConflictingOSVolumePolicies |
Detected OS volume encryption policies conflict. Check BitLocker and MBAM policies related to OS drive protectors. |
22 |
Microsoft-Windows-MBAM/Admin |
ConflictingFDDVolumePolicies |
Detected Fixed Data Drive volume encryption policies conflict. Check BitLocker and MBAM policies related to FDD drive protectors. |
23 |
Microsoft-Windows-MBAM/Operational |
MBAMAgentEvent |
Generic MBAM Agent event |
24 |
Microsoft-Windows-MBAM/Operational |
MBAMClientUIGenericEvent |
Generic MBAM Client UI event |
25 |
Microsoft-Windows-MBAM/Operational |
MBAMControlUIGenericEvent |
Generic MBAM Control Panel Applet event |
26 |
Microsoft-Windows-MBAM/Operational |
MBAMWmiProviderGenericEvent |
Generic MBAM WMI Provider event |
27 |
Microsoft-Windows-MBAM/Admin |
EncryptionFailedNoDra |
An error occurred while encrypting. A Data Recovery Agent (DRA) protector is required in FIPS mode for pre-Windows 8.1 computers. |
28 |
Microsoft-Windows-MBAM/Operational |
TpmOwnerAuthEscrowed |
The TPM OwnerAuth has been escrowed. |
29 |
Microsoft-Windows-MBAM/Operational |
RecoveryKeyEscrowed |
The BitLocker recovery key for the volume has been escrowed.. |
30 |
Microsoft-Windows-MBAM/Operational |
RecoveryKeyReset |
The BitLocker recovery key for the volume has been updated. |
31 |
Microsoft-Windows-MBAM/Operational |
EnforcePolicyDateSet |
The enforce policy date has been set for the volume |
32 |
Microsoft-Windows-MBAM/Operational |
EnforcePolicyDateCleared |
The enforce policy date has been cleared for the volume. |
10000 |
Microsoft-Windows-MBAM/Analytic |
Perf_EnactPolicyHelper_Begins |
The Enact Policy Helper starts. |
10001 |
Microsoft-Windows-MBAM/Analytic |
Perf_EnactPolicyHelper_Ends |
The Enact Policy Helper ends. |
10002 |
Microsoft-Windows-MBAM/Analytic |
Perf_SendStatusDataHelper_Begins |
The Send Status Data Helper begins. |
10003 |
Microsoft-Windows-MBAM/Analytic |
Perf_SendStatusDataHelper_Ends |
The Send Status Data Helper ends. |
10100 |
Microsoft-Windows-MBAM/Analytic |
Perf_MachineWmiProviderInstantiation_Begins |
Instantiation of MBAM's Machine WMI provider begins. |
10101 |
Microsoft-Windows-MBAM/Analytic |
Perf_MachineWmiProviderInstantiation_Ends |
Instantiation of MBAM's Machine WMI provider ends. |
10102 |
Microsoft-Windows-MBAM/Analytic |
Perf_VolumeWmiProviderInstantiation_Begins |
Instantiation of MBAM's Drive Volume WMI provider begins. |
10103 |
Microsoft-Windows-MBAM/Analytic |
Perf_VolumeWmiProviderInstantiation_Ends |
Instantiation of MBAM's Drive Volume WMI provider ends. |
Got a suggestion for MBAM?
Add or vote on suggestions here. For MBAM issues, use the MBAM TechNet Forum.