Skip to content

Event ID 203: OpenEventLog legacy API was used to open

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

OpenEventLog legacy API was used to open

Event 203
Eventlog
Security / System log
Verbose
Message and fields (as Event Viewer shows them) 
OpenEventLog legacy API was used to open ….

A command could not be submitted to the TPM.

Event 203
Kernel-Boot
System log
Error
Message and fields (as Event Viewer shows them) 
A command could not be submitted to the TPM.
Command code: ….
Error code: ….
Elapsed time: …ms.

PeriodicCheckpointComplete VolumeId: …, DirtyMetaDataPages

Event 203
Ntfs
System log
Information
Message and fields (as Event Viewer shows them) 
PeriodicCheckpointComplete VolumeId: …, DirtyMetaDataPages: …

Dispatching a write request.

Event 203
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Dispatching a write request.

When Credential Guard is enabled, Kerberos does not accept PKINIT KDC replies using public key encryption to ensure Kerberos tickets cannot be exported from the device.

Event 203
Security-Kerberos
System log
Warning
Message and fields (as Event Viewer shows them) 
When Credential Guard is enabled, Kerberos does not accept PKINIT KDC replies using public key encryption to ensure Kerberos tickets cannot be exported from the device. For more information, see https://go.microsoft.com/fwlink/?linkid=856823.

End system start drivers phase

Event 203
Kernel-PnP
System log
Information
Message and fields (as Event Viewer shows them) 
End system start drivers phase

Task Scheduler failed to launch action "…" in instance "…" of task "…".

Event 203
TaskScheduler
TaskScheduler/Operational log
Error
Message and fields (as Event Viewer shows them) 
Task Scheduler failed to launch action "…" in instance "…" of task "…". Additional Data: Error Value: ….

SMB2 Work Item activity id transfer

Event 203
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them) 
SMB2 Work Item activity id transfer

The BITS service provided job credentials in response to the … authentication challenge from the … server for the … transfer job that is associated with the following URL

Event 203
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them) 
The BITS service provided job credentials in response to the … authentication challenge from the … server for the … transfer job that is associated with the following URL: ….
The credentials for the … user were accepted.