From 9c48e4e64397dbc1d37ca354fdec4a751feadfb2 Mon Sep 17 00:00:00 2001 From: mgewida1 Date: Fri, 6 Jun 2025 10:21:36 -0700 Subject: [PATCH] Update configure.md removed event ID 51 --- .../credential-guard/configure.md | 23 ------------------- 1 file changed, 23 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/configure.md b/windows/security/identity-protection/credential-guard/configure.md index 2e5a9a8c07..e22e1a7aef 100644 --- a/windows/security/identity-protection/credential-guard/configure.md +++ b/windows/security/identity-protection/credential-guard/configure.md @@ -191,29 +191,6 @@ Open the Event Viewer (`eventvwr.exe`) and go to `Windows Logs\System` and filte :::column-end::: :::row-end::: -The following event indicates whether TPM is used for key protection. Path: `Applications and Services logs > Microsoft > Windows > Kernel-Boot` - -:::row::: - :::column span="1"::: - **Event ID** - :::column-end::: - :::column span="3"::: - **Description** - :::column-end::: -:::row-end::: -:::row::: - :::column span="1"::: - 51 (Information) - :::column-end::: - :::column span="3"::: - ```logging - VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. - ``` - :::column-end::: -:::row-end::: - -The TPM PCR mask is only relevant when SRTM is used. If the cached Copy status is 1, SRTM was not used - typically indicating DRTM is in use - and the PCR mask should be ignored. - ## Disable Credential Guard There are different options to disable Credential Guard. The option you choose depends on how Credential Guard is configured: