Office Software Protection Platform Service 1003 Terminal Server
Monitor unlimited number of servers
Filter log events
Create email and web-based reports
Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content
Office Software Protection Platform Registry
Event ID: 1003 Source: Microsoft-Windows-Security-SPP
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 2077f0b2-b2e2-43c5-a3b2-2079d527f56a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 2b117cfd-aed1-475e-b68f-d0c06ca9c4e8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 7f99509a-a8af-4839-a031-f36adc209a57, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: ae3800b9-bb05-4a4c-9d5e-1e25cd26975f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: bfb30674-7c9a-4624-9309-9914cfd5b05c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 3 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)( 7 0x00000000 2010/06/01)(?)(?)])(1 )(2 )]
6: e07989ff-9cc4-450c-8a0c-ffe9f7bfa57d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: e5903ef0-5584-484f-9e33-c1dc48ed160c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: f792792d-4d26-43f3-a568-8e0d98cd622c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: 18579d00-6c51-4907-a16e-3ba4aa9ba6f7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: fd8f859a-bb37-4928-bec1-2e7a2e8d9e4b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
We are still working on understanding what each of the GUID listed in the event represent.
Windows 7:
Activation ID: bfb30674-7c9a-4624-9309-9914cfd5b05c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Office 2010:
59a52881-a989-479d-af46-f275c6370663
Usually, this event is reported along with some notification about the software not being genuine or not activated. When this is the case, the GUID is followed by '1, 1' instead of '1, 0' - we are assuming that '1, 1' means a problem with the license. For example, this line:
5: bfb30674-7c9a-4624-9309-9914cfd5b05c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 3 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)( 7 0x00000000 2010/06/01)(?)(?)])(1 )(2 )]
* * *
In any case, one can use MGADiag.exe utility (Microsoft Genuine Advantage Diagnostic Tool) that can be used to generate a report about the various related components installed on that system. Go to EV100173 for download.
Aug 07, 2018 Why all of the 'Office Software Protection Platform Service' (event 1003) in the application log? I have had 12 of these in the past two hours. I have Office 2010 Pro, Visio 2010 Standard, and Project 2010 Standard (all retail boxes). Fixes an issue in which a Windows Server 2012-based server. Submit a request to Microsoft Customer Service and Support to. Platform; Fwpkclnt.sys: 6.2.
Office Software Protection Platform Removal
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.