Skip to content

Event ID 202: A pull subscription was created for

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

A pull subscription was created for

Event 202
Eventlog
Security / System log
Verbose
Message and fields (as Event Viewer shows them) 
A pull subscription was created for ….

A command could not be submitted to the TPM.

Event 202
Kernel-Boot
System log
Error
Message and fields (as Event Viewer shows them) 
A command could not be submitted to the TPM.
Command code: ….
Error code: ….
Elapsed time: …ms.

PeriodicCheckpointStart VolumeId: …, Reason: …, Usage: …%

Event 202
Ntfs
System log
Information
Message and fields (as Event Viewer shows them) 
PeriodicCheckpointStart VolumeId: …, Reason: …, Usage: …%

Dispatching a read request.

Event 202
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Dispatching a read request.

Attempt to export TGT session key failed.

Event 202
Security-Kerberos
System log
Warning
Message and fields (as Event Viewer shows them) 
Attempt to export TGT session key failed.

Target server: …
Supplied user: …
Supplied domain: …
PID of client process: …
Name of client process: …
LUID of client process: …
User identity of client process: …
Domain name of user identity of client process: …
Mechanism OID: …

This device does not allow exporting TGT session keys. For more information, see https://go.microsoft.com/fwlink/?linkid=856825.

Begin system start drivers phase

Event 202
Kernel-PnP
System log
Information
Message and fields (as Event Viewer shows them) 
Begin system start drivers phase

Task Scheduler failed to complete task "…" , instance "…" , action "…" .

Event 202
TaskScheduler
TaskScheduler/Operational log
Error
Message and fields (as Event Viewer shows them) 
Task Scheduler failed to complete task "…" , instance "…" , action "…" . Additional Data: Error Value: ….

SMB2 Work Item released

Event 202
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them) 
SMB2 Work Item released

While transferring …, BITS encountered error … using … as the HTTP proxy server.

Event 202
Bits-Client
Bits-Client/Operational log
Error
Message and fields (as Event Viewer shows them) 
While transferring …, BITS encountered error … using … as the HTTP proxy server.  The web server or proxy server does not support an HTTP feature required by BITS.  This problem can only be corrected by the administrator of the web server or proxy server.  Details: {job: …}, {owner: …}, {jobId: …}, {url: …}, {xferId: …}, {proxyServer: …}, {hr: …}, {urlContentLength: …}, {urlHttpVersion: …}, {urlRange: …}