Skip to content

Event ID 16: The access history in hive … was cleared updating … keys and creating … modified pages

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

The access history in hive … was cleared updating … keys and creating … modified pages.

Event 16
Kernel-General
System log
Information
Message and fields (as Event Viewer shows them) 
The access history in hive … was cleared updating … keys and creating … modified pages.

Windows failed to resume from hibernate with error status

Event 16
Kernel-Boot
System log
Error
Message and fields (as Event Viewer shows them) 
Windows failed to resume from hibernate with error status ….

Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule.

Event 16
WindowsUpdateClient
System log
Warning
Message and fields (as Event Viewer shows them) 
Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

Time Provider NtpClient: An unexpected error occurred during DNS lookup of the manually configured peer '…'.

Event 16
Time-Service
System log
Warning
Message and fields (as Event Viewer shows them) 
Time Provider NtpClient: An unexpected error occurred during DNS lookup of the manually configured peer '…'. This peer will not be used as a time source. The error was: …

Set adapter resource list

Event 16
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Set adapter resource list

An error occurred while encrypting a message

Event 16
Security-Kerberos
System log
Information
Message and fields (as Event Viewer shows them) 
An error occurred while encrypting a message: …

Local Multi-User session manager failed to start.

Event 16
TerminalServices-LocalSessionManager
TerminalServices-LocalSessionManager/Operational log
Error
Message and fields (as Event Viewer shows them) 
Local Multi-User session manager failed to start. The relevant status code was ….

OperationId = …; Operation = …; ErrorID = …; Message

Event 16
WMI-Activity
WMI-Activity/Operational log
Information
Message and fields (as Event Viewer shows them) 
OperationId = …; Operation = …; ErrorID = …; Message = …

SMB2 Request Lock

Event 16
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them) 
SMB2 Request Lock

BITS has sent an inquiry for peer servers.

Event 16
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them) 
BITS has sent an inquiry for peer servers.