Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	428	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1708	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:51 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	427	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1708	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:36 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	426	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4012	3128	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:33 PM	c7fe745a-0551-0005-3056-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	425	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4012	3128	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:33 PM	c7fe745a-0551-0005-3056-00c85105d701	c7fe745a-0551-0005-6d56-00c85105d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	424	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4012	1844	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:33 PM	c7fe745a-0551-0005-6d56-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	423	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4012	4920	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:32 PM	c7fe745a-0551-0005-3056-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	422	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4012	1844	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:32 PM	c7fe745a-0551-0005-3056-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	421	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1708	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:13:28 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	420	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:13:02 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	419	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:13:01 PM	c7fe745a-0551-0000-238f-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	418	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:13:01 PM	c7fe745a-0551-0000-238f-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	417	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1660	hv-cinder-76018	S-1-5-18	2/17/2021 6:13:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	416	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:13:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	415	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	414	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:58 PM	c7fe745a-0551-0005-273a-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	413	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:58 PM	c7fe745a-0551-0005-273a-00c85105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	412	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4852	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	411	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	410	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	409	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:44 PM	c7fe745a-0551-0003-7fa5-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	408	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:44 PM	c7fe745a-0551-0003-7fa5-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	407	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1660	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	406	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	405	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	404	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:43 PM	c7fe745a-0551-0001-d571-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	403	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:43 PM	c7fe745a-0551-0001-d571-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	402	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	516	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	401	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	400	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	399	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:41 PM	c7fe745a-0551-0002-4af6-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	398	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:41 PM	c7fe745a-0551-0002-4af6-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	397	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1660	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	396	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	395	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	394	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:30 PM	c7fe745a-0551-0001-2c6f-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	393	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:30 PM	c7fe745a-0551-0001-2c6f-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	392	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4852	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	391	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	390	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	389	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:20 PM	c7fe745a-0551-0002-1dcf-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	388	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:20 PM	c7fe745a-0551-0002-1dcf-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	387	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	8	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	386	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	385	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	384	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:11 PM	c7fe745a-0551-0005-0dc8-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	383	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:11 PM	c7fe745a-0551-0005-0dc8-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	382	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3724	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	381	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	380	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	379	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	378	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM	c7fe745a-0551-0002-2ccb-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	377	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM	c7fe745a-0551-0002-2ccb-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	376	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	940	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	375	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	374	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM	c7fe745a-0551-0005-0fc1-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	373	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM	c7fe745a-0551-0005-0fc1-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	372	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	8	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	371	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:12:01 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	370	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	369	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:52 PM	c7fe745a-0551-0002-f8c8-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	368	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:52 PM	c7fe745a-0551-0002-f8c8-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	367	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1868	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	366	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	365	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	364	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM	c7fe745a-0551-0001-9562-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	363	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM	c7fe745a-0551-0001-9562-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	362	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	516	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	361	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	360	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	359	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM	c7fe745a-0551-0004-4857-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	358	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM	c7fe745a-0551-0004-4857-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	357	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4508	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	356	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	355	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	354	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	353	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0000-0971-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	352	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0000-0971-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	351	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	552	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	350	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	349	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	348	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0001-2e60-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	347	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0001-2e60-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	346	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4028	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	345	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	344	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0002-dcc2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	343	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0002-dcc2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	342	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1156	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	341	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	340	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	339	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0003-7ccd-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	338	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM	c7fe745a-0551-0003-7ccd-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	337	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	892	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	336	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	335	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	334	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:47 PM	c7fe745a-0551-0002-c2c2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	333	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:47 PM	c7fe745a-0551-0002-c2c2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	332	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4508	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	331	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	330	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	329	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:40 PM	c7fe745a-0551-0002-7dc2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	328	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:40 PM	c7fe745a-0551-0002-7dc2-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	327	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1660	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	326	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	325	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:27 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	324	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	323	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM	c7fe745a-0551-0002-10b5-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	322	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM	c7fe745a-0551-0002-10b5-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	321	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1868	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	320	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	319	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM	c7fe745a-0551-0002-ebb4-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	318	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM	c7fe745a-0551-0002-ebb4-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	317	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	940	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	316	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	315	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	314	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:24 PM	c7fe745a-0551-0004-de43-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	313	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:24 PM	c7fe745a-0551-0004-de43-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	312	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	892	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	311	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	310	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	309	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0002-1fa9-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	308	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0002-1fa9-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	307	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1076	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	306	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	305	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	304	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0000-b311-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	303	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0000-b311-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	302	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1868	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	301	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	300	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1560	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	299	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0005-480c-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	298	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM	c7fe745a-0551-0005-480c-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	297	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1156	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	296	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	295	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	294	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	293	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	292	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM	c7fe745a-0551-0004-6219-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	291	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM	c7fe745a-0551-0004-6219-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	290	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3340	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	289	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	288	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM	c7fe745a-0551-0002-bd55-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	287	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM	c7fe745a-0551-0002-bd55-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	286	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1156	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	285	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	284	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3156	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	283	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	282	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM	c7fe745a-0551-0003-ec9b-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	281	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM	c7fe745a-0551-0003-ec9b-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	280	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4508	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	279	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	278	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM	c7fe745a-0551-0001-6cf1-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	277	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM	c7fe745a-0551-0001-6cf1-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	276	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	988	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	275	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	274	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	273	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:08 PM	c7fe745a-0551-0004-4d11-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	272	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:08 PM	c7fe745a-0551-0004-4d11-ffc75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	271	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	940	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	270	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:11:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	269	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	268	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	267	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM	c7fe745a-0551-0000-26ba-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	266	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM	c7fe745a-0551-0000-26ba-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	265	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1156	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	264	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	263	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM	c7fe745a-0551-0003-6d8e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	262	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM	c7fe745a-0551-0003-6d8e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	261	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	988	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	260	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	259	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM	c7fe745a-0551-0004-338d-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	258	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM	c7fe745a-0551-0004-338d-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	257	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1660	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	256	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	255	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:35 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	254	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:35 PM	c7fe745a-0551-0005-3f85-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	253	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:35 PM	c7fe745a-0551-0005-3f85-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	252	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4528	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:35 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	251	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:35 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	250	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	249	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	248	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM	c7fe745a-0551-0000-0eba-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	247	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4928	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM	c7fe745a-0551-0000-0eba-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	246	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	892	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	245	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	244	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM	c7fe745a-0551-0002-92d6-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	243	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM	c7fe745a-0551-0002-92d6-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	242	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	5092	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	241	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	240	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	239	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM	c7fe745a-0551-0005-2885-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	238	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM	c7fe745a-0551-0005-2885-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	237	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	988	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	236	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:10:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	235	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	234	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:53 PM	c7fe745a-0551-0003-428e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	233	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:53 PM	c7fe745a-0551-0003-428e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	232	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	552	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	231	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	230	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	229	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:52 PM	c7fe745a-0551-0003-2e8e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	228	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:52 PM	c7fe745a-0551-0003-2e8e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	227	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4528	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	226	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:52 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	225	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	224	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:51 PM	c7fe745a-0551-0003-148e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	223	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:51 PM	c7fe745a-0551-0003-148e-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	222	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	1076	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	221	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	220	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	219	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:47 PM	c7fe745a-0551-0001-0698-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	218	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3736	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:47 PM	c7fe745a-0551-0001-0698-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	217	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3812	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	216	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	215	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	214	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:45 PM	c7fe745a-0551-0000-bab9-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	213	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	4392	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:45 PM	c7fe745a-0551-0000-bab9-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	212	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	8	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	211	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler has began loading for application <none>.	41	0		4	14	1	4611686018427387906	210	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2140	3332	hv-cinder-76018	S-1-5-18	2/17/2021 6:09:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Protocol Handler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	209	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3740	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:40 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	208	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4512	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:38 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	207	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4068	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:34 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	206	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3740	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:32 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	205	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:29 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	204	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4512	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:26 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	203	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4068	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:23 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	202	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4512	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:20 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	201	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3740	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:17 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	200	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4068	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:14 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	199	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4356	4452	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:11 PM	c7fe745a-0551-0005-0683-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	198	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4356	4452	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:11 PM	c7fe745a-0551-0005-0683-fec75105d701	c7fe745a-0551-0000-16b8-fec75105d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	197	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4356	4812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:10 PM	c7fe745a-0551-0000-16b8-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	196	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4356	1972	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:10 PM	c7fe745a-0551-0005-0683-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	195	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4356	4812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:10 PM	c7fe745a-0551-0005-0683-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	194	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	4068	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:08:07 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	193	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:18 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	192	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1844	1908	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:10 PM	c7fe745a-0551-0002-c5d3-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	191	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1844	1908	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:10 PM	c7fe745a-0551-0002-c5d3-fec75105d701	c7fe745a-0551-0002-c7d3-fec75105d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	190	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1844	1360	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:10 PM	c7fe745a-0551-0002-c7d3-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	189	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1844	3780	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:10 PM	c7fe745a-0551-0002-c5d3-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	188	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1844	1360	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:10 PM	c7fe745a-0551-0002-c5d3-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	187	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 6:07:06 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	186	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:52:04 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	185	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:59 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	184	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:26 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	183	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:22 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	182	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:18 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	181	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:14 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	180	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:51:00 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	179	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:50:56 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	178	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:50:53 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	177	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:50:48 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	176	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:54 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	175	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:50 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	174	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1812	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:47 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	173	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:42 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	172	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:29 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	171	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:25 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	170	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:21 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	169	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:49:16 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	168	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:48:17 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	167	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:48:13 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	166	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:48:10 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	165	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:48:04 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	164	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:44:35 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	163	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:44:32 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	162	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:44:28 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	161	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:44:24 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	160	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:57 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	159	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1816	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:53 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	158	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:35 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	157	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3396	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:27 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	156	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:21 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	155	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:17 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	154	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:14 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	153	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:11 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	152	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:08 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	151	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:06 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	150	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3988	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:04 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	149	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:43:01 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	148	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1760	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:58 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	147	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:54 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	146	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:49 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	145	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3988	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:39 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	144	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:37 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	143	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:34 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	142	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:32 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	141	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:29 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	140	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:42:23 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	139	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:34:35 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	138	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:34:30 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	137	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:34:28 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	136	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:26 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	135	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:23 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	134	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:22 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	133	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:19 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	132	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3988	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:17 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	131	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:15 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	130	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3988	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:13 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	129	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:11 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	128	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:04 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	127	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:02 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	126	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:32:01 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	125	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:57 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	124	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:55 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	123	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:15 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	122	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:12 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	121	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:10 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	120	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:31:05 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	119	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:30:48 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	118	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:30:43 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	117	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:30:40 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	116	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:30:38 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	115	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:29 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	114	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:26 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	113	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:25 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	112	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:23 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	111	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:20 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	110	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3392	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:18 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	109	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:16 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	108	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1816	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:28:10 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	107	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	3936	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:52 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	106	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:49 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	105	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2296	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:47 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	104	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1340	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:45 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	103	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:35 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	102	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1388	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:24 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	101	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1796	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:18 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	100	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:27:02 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	99	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1788	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:59 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	98	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:56 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	97	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1308	3196	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:53 PM	c7fe745a-0551-0000-ab75-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	96	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1308	3196	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:53 PM	c7fe745a-0551-0000-ab75-fec75105d701	c7fe745a-0551-0001-6375-fec75105d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	95	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1308	2092	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:53 PM	c7fe745a-0551-0001-6375-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	94	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1308	1440	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:53 PM	c7fe745a-0551-0000-ab75-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	93	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1308	2092	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:53 PM	c7fe745a-0551-0000-ab75-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	92	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1748	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:38 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	91	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	1384	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1001	2/17/2021 5:26:26 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	90	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3340	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:59 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	89	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	88	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	2312	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	87	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	86	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3928	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	85	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	84	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3928	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	83	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	82	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3928	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	81	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	80	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3928	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	79	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	78	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	2312	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	77	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	76	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	2312	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	75	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	74	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	696	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	73	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3216	3260	hv-cinder-76018	S-1-5-21-819371805-336527973-903318486-1000	2/17/2021 5:25:58 PM	c7fe745a-0551-0004-a774-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	72	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2584	hv-cinder-76018	S-1-5-20	2/17/2021 5:25:08 PM	c7fe745a-0551-0001-bc74-fec75105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	71	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1352	2584	hv-cinder-76018	S-1-5-20	2/17/2021 5:25:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	70	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	1888	hv-cinder-76018	S-1-5-20	2/17/2021 5:24:32 PM	7bdcb4fc-0551-0000-33b5-dc7b5105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	69	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	1888	WIN-5T344G8GM1H	S-1-5-20	2/17/2021 5:24:32 PM	7bdcb4fc-0551-0000-33b5-dc7b5105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	68	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	2152	WIN-5T344G8GM1H	S-1-5-20	2/17/2021 5:23:12 PM	7bdcb4fc-0551-0000-33b5-dc7b5105d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	67	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	2152	WIN-5T344G8GM1H	S-1-5-20	2/17/2021 5:23:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	66	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	65	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke completed successfully	132	0		4	10	2	4611686018427387906	64	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3660	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/service	145	0		4	5	1	4611686018427387906	63	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3176	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	62	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	61	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	60	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	59	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	58	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	57	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	56	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	55	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	54	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	53	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	52	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	51	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	50	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	49	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	48	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	47	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	46	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	45	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	44	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	43	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	42	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	41	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	40	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	39	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	38	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	37	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	36	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	35	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	34	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	5108	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	33	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	32	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	2904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	31	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	30	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	29	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	28	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	27	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	26	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:25 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	25	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	24	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	23	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	22	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	21	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	20	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2624	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	19	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	18	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	17	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	16	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:56 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	15	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:55 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	14	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	13	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	12	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	11	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	10	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2888	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	9	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	8	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2480	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	7	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	6	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	5	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	4	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	3	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM service is unable to start because of a failure during initialization. The error code is 2	210	0		2	11	2	4611686018427387908	2	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	1	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]