
Self-Encrypting Drive Management | Wave Systems Corp. 2012
ESC 2.9.5 Client Manual
8.16 Event Viewer Notifications
The notifications relating to self-encrypting drives are listed under “Windows Logs” -> “Application” in
Event Viewer. They can be filtered in event viewer by selecting “Wave Platform Security” as the source,
and using the task category “Wave Platform Trusted Drive Security Events”. Most events are
“Information” level, however a warning is issued when the drive is uninitialized.
Figure 3 - Log Recording Drive Locking in Event Viewer
Event Viewer Notifications:
Message ID Event
Event ID 3000 Initialization started.
Drive [Letter], Serial Number [Serial Number] is being initialized.
• Indicates drive initialization has begun. If the computer is shut down before this process
completes unexpected behavior could occur.
Event ID 3001 Initialization failed.
• The drive could not be initialized. No changes have been made to the drive.
Event ID 3002 Initialization succeeded.
Drive [Letter], Serial Number [Serial Number] has been initialized, Drive Administrator is User
[Domain\Username].
• The drive is initialized. The named user is the only one who can make administrative changes to
the drive. The Drive Administrator will be the ERASService account in most enterprise
deployments.
Event ID 3003 Un-initialization started.
Drive [Letter], Serial Number [Serial Number] is being uninitialized.
• Indicates drive un-initialization has begun. If the computer is shut down before this process
completes unexpected behavior could occur.
Event ID 3004 Un-initialization failed.
• The drive could not be un-initialized. No changes have been made to the drive.
Komentáře k této Příručce