Event ID 4: License policy-cache has expired because it was not updated within expected duration
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
License policy-cache has expired because it was not updated within expected duration.
Event 4
Kernel-General
System log
Information
Message and fields (as Event Viewer shows them)
License policy-cache has expired because it was not updated within expected duration.
Boot library accessed file … on Device
Event 4
Kernel-Boot
System log
Information
Message and fields (as Event Viewer shows them)
Boot library accessed file … on Device …. Read … bytes and wrote … bytes.
The time provider '…' failed to start due to the following error
Event 4
Time-Service
System log
Error
Message and fields (as Event Viewer shows them)
The time provider '…' failed to start due to the following error: …
The NTFS volume has been successfully mounted.
Event 4
Ntfs
System log
Information
Message and fields (as Event Viewer shows them)
The NTFS volume has been successfully mounted.
Volume correlation Id: …
Volume name: …
Volume label: …
Device name: …
Device GUID: …
Device manufacturer: …
Device model: …
Device revision: …
Device serial number: …
Bus type: …
Device number: …
Boot partition: …
Native NVMe: …
Adapter serial number: …
Total mount duration: …
Longest stage: …. Duration … (…% of the total)
Second longest stage: …. Duration … (…% of the total)
Volume restart applied: …
Reset detected notification
Event 4
StorPort
System log
Information
Message and fields (as Event Viewer shows them)
Reset detected notification
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server
Event 4
Security-Kerberos
System log
Information
Message and fields (as Event Viewer shows them)
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server …. The target name used was …. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (…) is different from the client domain (…), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
SMB2 Request Tree Connect
Event 4
SMBServer
SMBServer/Operational log
Information
Message and fields (as Event Viewer shows them)
SMB2 Request Tree Connect
The transfer job is complete.
Event 4
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them)
The transfer job is complete.
User: …
Transfer job: …
Job ID: …
Owner: …
File count: …
Automatic certificate enrollment for … invoked the enrollment API.
Event 4
CertificateServicesClient-AutoEnrollment
Application log
Information
Message and fields (as Event Viewer shows them)
Automatic certificate enrollment for … invoked the enrollment API.