Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 824 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2960 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:10:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 823 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2960 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:09:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 822 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2960 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 821 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2960 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:07:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3672; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 820 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3672 | 3216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 819 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 620 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:05:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {04C0F607-E04F-4F83-85D5-FABF8DD28C30}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=845483060; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 818 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:41 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B13FA1E7-67BB-42CB-AAE3-8155635BE9D7}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1751155645; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 817 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0D110A53-036B-4DD6-974F-1815A00286DF}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1157317412; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 816 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3720 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {151904FA-7E3E-4E3E-8C9E-89470757FB95}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1137580556; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 815 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D6992799-56F6-4960-AF3B-87D8FE6A45F6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1110487077; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 814 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EBBA75A2-9BA3-451B-935C-E5466E1EAD3C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1989000445; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 813 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3600 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2CB793C8-3311-4C1B-BEE4-E860E0A8EE38}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1840942591; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 812 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:05:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4B6ED3DB-08E5-4198-A34A-4CF237A041DF}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=814461199; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 811 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {59AA0BC6-FBED-4135-BF9B-1DA94C900C16}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3056; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:A9EEADF7-9E84-40F1-A6C3-B4DCA9B7863C"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 810 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEDBA6AC-0E67-4853-B2D7-797D3F5D108D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1942408692; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 809 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {50DDDF9C-13E4-4A4A-9A0E-0DAC904572C5}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1052520185; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 808 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:41 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8F97BC52-C18B-4A1E-A729-FB08673B8278}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-784114a6-be82-41c8-bb89-520ba76a19b8"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 807 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9335D3ED-DD57-421C-8043-4D5E7C853F6D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-784114a6-be82-41c8-bb89-520ba76a19b8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 806 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {867643A6-5737-4F1B-8767-6D38A6B411C8}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1569721826; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 805 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B98BCB39-C012-46DF-83D4-70F01C66B75E}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0802C5B1-1D5E-4153-A778-0672D569AB40}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 804 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6D76449F-39F3-4C8D-AC37-B48396058B18}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0A69F599-BDE3-43E5-B9B7-755B4A0630EF}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 803 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F3FBF835-E7A4-4116-A230-58265F144E1C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{27FE92B4-A25A-4A40-A60C-B1A3709096A5}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 802 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 801 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:04:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2A7422A4-ABA2-4DB7-AB82-6C7AC5B44738}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e9459445-5467-4d4b-a205-55fef0ad4519"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 800 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9AAE3659-A0C9-4E8D-BDF9-3D56A9106293}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e9459445-5467-4d4b-a205-55fef0ad4519",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 799 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:04:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E5346FC3-EA7A-4F84-8860-307EBE59BA0F}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1615705792; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 798 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:53 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {77C9D510-00C7-4C2B-9C23-17047FA5C698}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1748011598; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 797 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B1E92605-BFEF-40CF-AD4A-9A518674C927}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=227949736; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 796 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {83CFCBC2-471B-4C14-8C72-DB307C4079B6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1615791986; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 795 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3720 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3C36F2EA-7741-437B-B08C-4B6F15146FB5}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{85D72D79-26A9-4B24-932D-842027929D2C}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 794 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F32C8B0-C25D-4CCD-9017-ACBB559C8253}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=947754375; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 793 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F80C639-B570-49AB-B35F-9D9386900902}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{65231F7F-8A15-43D3-B8F7-98C016DA63C9}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 792 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {199E40D6-B3DC-48C0-9DEE-686366C1A321}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-292858c1-1239-47e7-bf93-72c176daafb6"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 791 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AEED0629-8A7B-4ECC-964E-E7D46FEF1C10}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1095583955; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 790 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8E71C2E2-BE07-4138-96F1-D89707CA6518}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-292858c1-1239-47e7-bf93-72c176daafb6",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 789 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:03:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 788 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:03:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 787 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:03:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C2631129-B3B5-410C-A9AF-58431E254F7C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=302040499; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 786 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:02:53 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E3EEF993-B5D2-4054-9357-1E630BB616C6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0682159F-6CAF-464B-A030-43F49907C793}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 785 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:02:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BB180CAC-BCCB-4AE1-B43B-6AC5FBF4A605}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1152951895; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 784 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:02:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E12FCE72-9208-4356-B0D0-DC0DFC0AF89B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=895746338; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 783 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:02:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EF1AC1C3-B4B4-4154-837E-2DF7C2CFEE57}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=957529347; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 782 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:01:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9B1E1077-FFD8-4209-9F88-8E2A67F89C8C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1429263869; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 781 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:01:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {32D9CD4F-C7A5-4119-95C2-B9F493065726}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1767008729; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 780 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:01:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4989546D-A747-4B09-86C4-EC45CF5503EC}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1553207170; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 779 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 3:01:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 778 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:01:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2328; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 777 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2328 | 3380 | hv-cinder-76019 | S-1-5-19 | 9/7/2021 3:01:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 776 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 3:01:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 775 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:58:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F4CF5D7F-77B1-4C4A-AF70-34005DB50391}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=626872473; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 774 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {853D96FF-C3E0-4846-A3EC-BBA8D5154C3D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-cd21bca4-ba18-4ae2-99e2-b037519f7ebb"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 773 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DF90AA3A-32B9-4661-A6B8-67678FD259CB}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6e40669c-4848-456a-81bc-71cf2e524982"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 772 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B926A8BE-830D-4189-A470-9924455B3217}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-def85120-ac9d-48b9-a547-67301063a0c6"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 771 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {162A351B-4B01-47A3-993B-F244B62440C6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d7d3716e-b300-4e6a-b3cc-213de41c9ec1"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 770 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 769 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:57:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C137E3CB-D8ED-4D00-8D42-E3B36CE09623}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{71AB71AB-08BB-419B-A02F-FE8D650EA60D}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 768 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C3BE5BF-C55B-41BC-AC15-8A3BFF444DB1}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-cd21bca4-ba18-4ae2-99e2-b037519f7ebb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 767 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7BB0A87D-4332-453F-9CF3-F81A0896DDD0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6e40669c-4848-456a-81bc-71cf2e524982",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 766 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D914BC3A-BA52-47D4-A2E0-C17826242889}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-def85120-ac9d-48b9-a547-67301063a0c6",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 765 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {73BF9567-8475-444F-A151-93D821A14531}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d7d3716e-b300-4e6a-b3cc-213de41c9ec1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 764 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4276; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 763 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4276 | 4400 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EE8E83B9-52FF-4DC1-A78D-4D2C30A5D7B1}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\wmi : WT_Snapshot::Create; ResultCode = 0x800705B4; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 762 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:57:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F30BF65-97FC-4980-9EC5-E249DFF5F1A0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3056; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:94F070B2-614A-457F-A580-EB0E9153F573"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 761 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:49:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 760 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:46:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 759 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:39:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 758 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:38:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 757 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:32:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 756 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:29:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 755 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:28:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 754 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:26:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {ED15C2CB-D173-4228-BD69-4716173C608A}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1791862402; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 753 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {160D469B-51FD-4786-879C-0900E649E148}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B956B163-19DA-41AF-89BA-2CC455FC8645}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 752 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3600 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {98F4A0EE-71E5-48D0-A0BF-55C55BBC03A6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{174495E5-9F55-49E9-AA21-399D1BE435FE}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 751 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 750 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:25:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C6A9F19D-0EAC-47F2-8080-52BF97C1D44D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8F59B15A-D4FD-4FE8-8E45-0D019ABDB989}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 749 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3600 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D98E464E-E0FC-43A9-8262-B7323D52A531}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9A5742F9-0880-4F5E-A622-23688334055C}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 748 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AD2FD545-5DA2-442A-BD12-AF5197E6517C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D844EF76-68D1-4D0C-BFA5-937A0A686BFD}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 747 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1520 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5E08DEA9-947E-464B-BC65-DF8CC403DB3B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=921816601; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 746 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2216 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:25:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CE397EF4-BAF6-4E6B-874B-02230509244C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{450D6392-4DF3-4E48-ABC1-11E3BB82A83E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 745 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {58D11D58-2416-447B-BCBB-64D857E41DAF}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=279664135; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 744 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {42D33A14-D601-4D6F-9B8D-7686A4F310FB}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1529690552; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 743 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D17228E2-F714-472D-AD83-271416E06A87}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1316935595; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 742 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {99C98A87-1BE6-427D-BB7D-E8ED26882101}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-79e673aa-2e77-4df7-8f3f-3eabf13f3340"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 741 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B3476A93-4EE3-4A30-B00C-C27E602BE64D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-79e673aa-2e77-4df7-8f3f-3eabf13f3340",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 740 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 739 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:24:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B4D4C28E-B286-4D00-9BC1-FDC302A45DC0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A5850686-5834-427F-8DD2-E13C0898E350}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 738 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {80A611F8-8AB6-4E4B-9A31-F143E1A244A4}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{41239F44-B43E-4C91-869C-73DE298F57A5}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 737 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D1691A5C-CD52-4B81-A2B1-06B3E8C9E0F1}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F8E8292F-71EB-452B-A30D-936A6EFB1DB8}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 736 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E2382AE0-D4D9-4562-979E-29849D290EED}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3056; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:8C3F72BA-55A3-42F9-A6B5-9463989BA324"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 735 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {44AD7D3E-917F-440B-8C05-BED9BE4E58D4}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1600442961; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 734 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:24:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C6E223A1-A854-43EC-AC1A-3C024CEBAC9B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2074083019; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 733 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A7780E62-F848-4BB9-BF20-9E4F2723777F}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1888048403; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 732 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E3622EF1-1CF6-4FEF-AE57-D01F5F8DAE8B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=480124101; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 731 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4249DB81-3C75-4335-8B0D-3411389D271D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1195664286; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 730 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E85DB8F2-8900-42DA-8AFD-FF2743BF234B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1095558808; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 729 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CF795D8A-4539-4712-A335-C000BDB21C28}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1161660470; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 728 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C184BD0F-1058-4241-8264-5C69D875FAA3}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EA00C01E-CD93-42EC-96AC-8D507039238D}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 727 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6FA62798-3F43-4CB1-8753-7E9B319DD1F9}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1873305149; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 726 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {375CA811-D525-481D-B286-385FE9A80D6B}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-3ddbd1b1-e84b-44a8-944b-bbb7e0d7131a"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 725 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BD4A8865-6BE3-4905-B647-77BA53A41A16}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1541698531; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 724 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {26D8D2C7-D638-4844-B0F7-DB77121C43BE}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-3ddbd1b1-e84b-44a8-944b-bbb7e0d7131a",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 723 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DD21AE3D-918B-4AD0-BF19-666289250FB9}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7F42E40E-6002-416F-95F7-F81CD08CA529}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 722 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F2C3C0E2-D1D0-4E7B-A403-2C8A1BB54C3F}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2006727587; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 721 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3600 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {70D1A5A5-D256-449E-B0C2-A5109C61BCE7}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1428078357; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 720 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0D579478-F954-44E7-B46F-28402635E3EE}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1474258665; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 719 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4C2F31D1-BCD7-45B9-99C2-107723812BBC}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1237078323; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 718 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F9CE4D2-C511-42E5-9E86-27AA7ABAA6C5}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1193359637; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 717 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E63BA54F-3910-462F-B628-A096486ACBE6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1716293141; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 716 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6239B380-8445-4B54-B5CE-5E8E39867B97}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=261956460; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 715 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:23:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C2C2462-2E9F-4666-B5B9-6490473065F2}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=287962663; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 714 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 713 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:22:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6FBD941E-E6B4-46FF-8656-15BECA051872}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1171680306; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 712 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1140 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2C376F35-8455-42BE-ADE9-B44D36421EAA}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=233478982; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 711 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9D3A934F-88F5-41DA-A48A-5176A1AB13D8}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1664332675; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 710 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D45BCC8E-2604-4AF5-9862-9B831721A0F5}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1476707438; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 709 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DAD5B899-6786-40CF-B167-CF86D603238C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1530393411; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 708 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A83E6969-A938-42B8-A0DD-9EFE479A4A67}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=744061503; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 707 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {546C7AA5-7A89-4A12-AE14-C02764DEA174}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=389538601; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 706 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AAE19B63-A586-4930-B7E3-1778F3C752F0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1219862971; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 705 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A91E5CF7-8E6B-4D0B-9B13-A05421C4EBCE}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EA79532F-80D3-4B53-ACC7-3B49D42BF9DB}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 704 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {75CB72D3-0B15-4A02-9A85-262E5733C894}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9E124CE7-3F90-4D98-B2D6-A99266B3FCD4}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 703 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {13CE46DE-CC96-4868-96A1-4355765FB0B2}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=723258823; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 702 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {712B3D60-C0C7-48F2-AB5E-8428E5917992}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=981641066; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 701 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9854E3FA-7417-4C3C-B53B-2E35EBCA5CD7}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=979872130; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 700 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FEF97AC2-6025-4F23-97DF-06E11E60EF42}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1287236843; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 699 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D36FA5EA-DD69-4139-A456-93A8D0A03D9A}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-426df267-afc0-48ef-93a2-553d83c8a99a"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 698 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {508EDD9B-E74F-4734-9124-5384514DF9F1}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-426df267-afc0-48ef-93a2-553d83c8a99a",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-76019"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 697 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0F30897A-6DED-4C3D-BFF2-ABECC80DEC39}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3CF6F916-747D-4BF6-8EB1-343B565E8A8E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 696 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5FA067F9-43B8-49B5-BA8E-3F049FB6C29F}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3B326C16-DC7A-4BC2-82BD-19E75B4EDD2E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 695 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F574972B-385E-4B9C-BCAA-6D63135ACBCD}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1248695878; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 694 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B23B0187-8CE6-4DF3-9093-FCDE7A1B976E}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=242766113; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 693 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {599D501F-AD3C-4252-A5D2-6099C1943FB0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1421904557; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 692 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {58C78C0A-FEAC-4682-AC40-67FB52EDE1B0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0AEF27E6-B45E-41EB-961D-418331502714}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 691 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FE712297-D4AB-492A-A49A-33646840B31D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1844569085; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 690 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EB1261B6-D6F7-4484-BB3D-AF6D77858657}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{796CEA0F-0E62-4F85-B40D-FF757BFC7F66}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 689 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {60E09720-626C-4220-AF37-FB104A084347}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1933226895; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 688 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:22:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C664BC92-7862-4F1E-936F-2A1431DC348C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=437370835; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 687 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {978138BD-1063-465A-9C11-6E4C59D016FF}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=411358413; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 686 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E16C8D06-0765-49E0-8F1D-7ECA51BE3E39}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1976250264; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 685 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 684 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:21:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C165FFC1-F440-4D4C-BAD0-6B403F4D97D0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6417F5CC-ED13-4170-A426-BA2FA064CB97}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 683 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 5016 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B7ED1CD4-9D02-477C-AE28-2967C4D4F5C7}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1622437046; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 682 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A872F787-49FF-4814-A674-D6F442E97BD0}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=713034191; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 681 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 508 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0B3A3ACD-C895-4E34-B13E-67982E2BEDA8}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=697191598; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 680 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9F305A99-5DBE-43AB-BF2F-C6C7DBD94784}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1977611775; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 679 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7013A175-B9B6-4933-B087-FA004C14CF0A}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{3BACF445-3B35-4ED0-9BCE-6B2C9106BFB7}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 678 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2912 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1055A47E-F473-4397-8E6C-4E4518DC9772}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=116179389; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 677 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0E7E21A7-8407-4E41-B878-7662F064039E}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1906803131; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 676 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3677180C-8503-4E73-B541-6EFC54AC9AC8}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1041263071; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 675 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 596 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {611F2EC0-5353-4B94-B7CB-5545269A0173}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2058341134; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 674 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1796 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A7324C82-4F20-4DBB-8DD6-67F589D70B5C}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DDDF0E25-F852-4588-A7FF-AD3724F3CBB1}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 673 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0110EBB2-FA76-4CE2-920B-0F7D4BED866D}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DF94D0F2-1F79-4D8E-A0D0-0479296C2A2C}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 672 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3944 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AA7478CD-3F38-4078-BC05-D918F8971F68}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1360128738; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 671 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E7FEE138-15D6-4E1F-AD95-FBE422313548}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1390379493; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 670 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B4295310-9016-4F09-BBD2-98C52CF4BEE6}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1307307560; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 669 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4116 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C2F7D765-D436-42F9-8F18-58767DFEEA48}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1380; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D02CCB3F-2B9E-4399-9DA1-38B7062CE2F0}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 668 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4324 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:21:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 667 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 3680 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:20:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 666 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2376 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:20:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4500; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 665 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4500 | 3140 | hv-cinder-76019 | S-1-5-19 | 9/7/2021 2:20:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 664 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 2376 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:20:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4604, ClientMachine = HV-CINDER-76019; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 663 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4800 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:18:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4604, ClientMachine = HV-CINDER-76019; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 662 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4800 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:18:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 3056, ClientMachine = HV-CINDER-76019; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 661 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 4800 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:18:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3952; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 660 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3952 | 748 | hv-cinder-76019 | S-1-5-19 | 9/7/2021 2:18:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4400; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 659 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4400 | 3876 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:18:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 658 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:18:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4220; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 657 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4220 | 1832 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 2:18:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 656 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:18:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1272; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 655 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1272 | 4100 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 2:18:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4232; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 654 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4232 | 3860 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:58:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1076; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 653 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1076 | 3248 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:57:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1076; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 652 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1076 | 180 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:57:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1076; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 651 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1076 | 3248 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:57:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3632; ProviderPath = %systemroot%\system32\wbem\msiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 650 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3632 | 3668 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:36:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 649 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2968 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:33:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4936BFAC-A3EC-0003-2EC3-3649ECA3D701}; ClientMachine = HV-CINDER-76019; User = HV-CINDER-76019\Admin; ClientProcessId = 2664; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 648 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2068 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4936BFAC-A3EC-0003-2EC3-3649ECA3D701}; ClientMachine = HV-CINDER-76019; User = HV-CINDER-76019\Admin; ClientProcessId = 2664; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 647 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1268 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4936BFAC-A3EC-0003-2EC3-3649ECA3D701}; ClientMachine = HV-CINDER-76019; User = HV-CINDER-76019\Admin; ClientProcessId = 2664; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 646 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1268 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-76019\Admin; ClientProcessID = 2664, ClientMachine = HV-CINDER-76019; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 645 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1268 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-76019\Admin; ClientProcessID = 2664, ClientMachine = HV-CINDER-76019; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 644 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1268 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 643 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3548 | 3628 | hv-cinder-76019 | S-1-5-19 | 9/7/2021 1:32:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 642 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2968 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:32:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2592; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 641 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2592 | 3332 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:32:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1608; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 640 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1608 | 2112 | hv-cinder-76019 | S-1-5-19 | 9/7/2021 1:32:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3632; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 639 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3632 | 3672 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:32:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2592; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 638 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2592 | 4088 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:32:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 637 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2800 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:32:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wfascim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 636 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2968 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:32:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 635 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2968 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:31:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4092; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 634 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4092 | 1804 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:30:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 633 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:30:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 632 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:30:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3232; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 631 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3232; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 630 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3632; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 629 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3632 | 3672 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = HV-CINDER-76019\cloudbase-init; ClientProcessId = 3000; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 628 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 504 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %SystemRoot%\System32\sppwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 627 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 626 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2988 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 625 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2988 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 624 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1632 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 623 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 622 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1632 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 621 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2988 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 620 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2208 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 619 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2208 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 618 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2208 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 617 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2208 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 616 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2988 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 615 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 614 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2880 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3176; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 613 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 1632 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4092; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 612 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4092 | 3952 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 611 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 610 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 609 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 608 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 607 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 606 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 605 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 604 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 603 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 602 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 601 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2676 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 600 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 599 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 598 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 597 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 596 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 595 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 594 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 593 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 592 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 591 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 590 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 589 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 588 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 587 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 586 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 585 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 584 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 583 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 582 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 581 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 580 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 579 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 578 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 577 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 576 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 575 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 574 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 573 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 572 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 571 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 570 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 569 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 568 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 567 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 566 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31B604DB-771E-43E4-AB64-3ADFD49E6989}; ClientMachine = HV-CINDER-76019; User = ; ClientProcessId = 588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 565 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 564 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 588; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 563 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3984 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:18 PM | 4936bfac-a3ec-0004-0dc0-3649eca3d701 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 562 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2628 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 561 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 3980 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3632; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 560 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3632 | 3672 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3632; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 559 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3632 | 3672 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2612; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 558 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2676 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 557 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 2804 | hv-cinder-76019 | S-1-5-20 | 9/7/2021 1:29:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-76019; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1108; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_1318080368_2455559186_516066477_500"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 556 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 588 | 2644 | hv-cinder-76019 | S-1-5-18 | 9/7/2021 1:29:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-FLGHM4R3HCD; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3068; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 555 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2992 | WIN-5T344G8GM1H | S-1-5-18 | 9/7/2021 1:28:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-FLGHM4R3HCD; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3068; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 554 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2992 | WIN-5T344G8GM1H | S-1-5-18 | 9/7/2021 1:28:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-FLGHM4R3HCD; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2172; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 553 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2300 | WIN-5T344G8GM1H | S-1-5-18 | 9/7/2021 1:27:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-FLGHM4R3HCD; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1676; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 552 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2300 | WIN-5T344G8GM1H | S-1-5-18 | 9/7/2021 1:27:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 551 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 550 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 549 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 548 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 547 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4848 | 4776 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:45:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 546 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 1176 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll" | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 545 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 544 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 543 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 542 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 541 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 540 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 539 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 538 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 537 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:43 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 536 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 535 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 534 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 533 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2172 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | ad8d0f9c-9109-0001-0a10-8dad0991d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 532 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 531 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 388 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 530 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 529 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 528 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 527 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 526 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 525 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 524 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 523 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 522 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 521 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 520 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 519 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 518 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 517 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 516 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 515 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 514 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 513 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 512 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 511 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 510 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 509 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 508 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 507 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 506 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 505 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 504 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 503 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 502 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 501 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 500 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 499 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 498 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 497 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 496 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 495 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 494 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 493 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 492 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 491 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 490 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 489 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 488 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 487 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 486 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 485 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 484 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2848 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 483 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2692 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 482 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 1548 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:40:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 481 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 480 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 479 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 478 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 477 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 476 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 475 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 474 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 473 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 472 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 471 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 470 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 2924 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 469 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4444 | 4516 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 468 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 467 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 466 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 465 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 464 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1548 | 2160 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 463 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 462 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 461 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 764 | 1020 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:33:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 460 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 459 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 458 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:31:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 457 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 456 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 455 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2716 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 454 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 453 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4608 | 4636 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 452 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2896 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 451 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4344 | 4368 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 450 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:25 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 449 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 448 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:19 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 447 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | aff0bd57-9107-0002-9bbd-f0af0791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 446 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 445 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 444 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 443 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 442 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 441 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 440 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 439 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 438 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 437 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 436 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 435 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 434 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 433 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 432 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 431 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 430 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 429 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 428 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 427 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 426 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 425 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 424 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 423 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 422 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 421 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 420 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 419 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 418 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 417 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 416 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 415 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 414 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 413 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 412 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 411 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 410 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 409 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 408 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 407 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 406 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 405 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 404 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 403 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 402 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 401 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 400 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 399 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 398 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 397 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 396 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 395 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 394 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 393 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 392 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 391 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 390 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 389 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 388 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 387 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 386 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 385 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 384 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 383 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 382 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 381 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 380 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 379 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 378 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 377 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 376 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 375 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 374 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 373 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 372 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 371 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 370 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 369 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 368 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 367 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 366 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 365 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 364 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 363 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 362 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 361 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 360 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 359 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 358 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 357 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 356 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 355 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 354 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 353 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 352 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 351 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 350 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 349 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 348 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 347 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 346 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 345 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 344 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 343 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 342 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 341 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 340 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 339 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 338 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 337 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 336 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 335 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 334 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 333 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 332 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 331 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 330 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 329 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 328 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 327 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | 96ed06e7-9107-0000-3d07-ed960791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 326 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 325 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 324 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 323 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 322 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 321 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 320 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 319 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 318 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 317 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 316 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 315 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 314 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 313 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 312 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 311 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 310 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 309 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 308 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 307 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 306 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 305 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 304 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 303 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 302 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 301 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 300 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 299 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 298 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 297 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 296 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 295 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 294 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 293 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2864 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:42 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 292 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2620 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 291 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 290 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2528 | 3456 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:24:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 289 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 288 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 3804 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 287 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 286 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 285 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3200 | 3644 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 284 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2920 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 283 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2540 | 3240 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 282 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 281 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 280 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 279 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2916 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | 17f2f0cc-9107-0002-12f1-f2170791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 278 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2908 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 277 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 276 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3808 | 4032 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:14:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 275 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 274 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2972 | 156 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 273 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 272 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 1584 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 271 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4136 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:11:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 270 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4368 | 4496 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:10:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 269 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1784 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:05:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 268 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 267 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 1396 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 266 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 265 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 1000 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 264 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 3364 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:58:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 263 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 262 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 261 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 260 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 259 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | 289cfce6-9103-0003-f9fd-9c280391d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 258 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 257 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:06 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 256 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 255 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:55:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 254 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4020 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 253 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 4052 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 252 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 251 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 3996 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 250 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3880 | 3916 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 249 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 3004 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:34 AM | 7c5c4ffb-9102-0000-4a51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 248 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1200 | 2840 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 247 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | 7c5c4ffb-9102-0001-8851-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 246 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 245 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | 7c5c4ffb-9102-0001-5f51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 244 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 243 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3932 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 242 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:37 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 241 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 428 | 1316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 240 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 239 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3888 | 3916 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 238 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 237 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3860 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 236 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4796 | 840 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:45:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 235 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2284 | 2676 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:44:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 234 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 233 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2300 | 4360 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 232 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 231 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 3736 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 230 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1052 | 4868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:36:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 229 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3184 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 228 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 4616 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 227 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 226 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 225 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 224 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 223 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 222 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 221 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2920 | 4532 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 220 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 219 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 218 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4228 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:15 AM | 9a81cb05-910f-0003-8acc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 217 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 216 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 215 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 214 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 213 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 212 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 211 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 210 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 209 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 208 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 207 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 2868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 206 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1912 | 3084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 205 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 204 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 203 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 202 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4324 | 3568 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:27:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 201 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | 9a81cb05-910f-0000-a4cc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 200 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 199 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 198 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:25:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 197 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | 9a81cb05-910f-0003-4bcc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 196 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 195 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 194 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4124 | 4152 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 193 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3820 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 192 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3084 | 3436 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 191 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 190 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 189 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 188 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 3176 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:37:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 187 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 186 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2788 | 2624 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 185 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 184 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2440 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 183 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 3868 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:27:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 182 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 181 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1500 | 2664 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 180 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 179 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 4056 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 178 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 652 | 1972 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:17:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 177 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 3152 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 176 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3124 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 175 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1184 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 174 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1160 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 173 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1088 | 4088 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:10:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 172 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 171 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | b65c0852-8ef4-0003-8709-5cb6f48ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 170 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 169 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 168 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 167 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4072 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 166 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4076 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 165 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4060 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 164 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 163 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 162 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 161 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 160 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 159 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 158 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 157 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 156 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 155 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 154 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 153 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 152 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 151 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 150 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2832 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 149 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 148 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4892 | 836 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:02:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 147 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4256 | 4144 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:53:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 146 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 145 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5092 | 2628 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 144 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 143 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 5116 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 142 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4780 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:50:11 PM | 53b2b737-8ef1-0000-6db9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 141 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 2160 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:46:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 140 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | 53b2b737-8ef1-0003-feb9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 139 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 138 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 137 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4212 | 4236 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 136 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2796 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 135 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3216 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 134 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3208 | 3308 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 133 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 132 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 131 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 130 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | 53b2b737-8ef1-0001-8eb7-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 129 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 128 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:37:24 PM | a4626349-8ea8-0003-b36d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 127 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 164 | 3628 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:35:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 126 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:35:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 125 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 428 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 124 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 5928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 123 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | a4626349-8ea8-0002-ed6e-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 122 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 121 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5028 | 5328 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:32:53 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 120 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 119 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3816 | 1224 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 118 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 117 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 912 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 116 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3180 | 804 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:22:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 115 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 114 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 888 | 5288 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 113 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 112 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 111 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5964 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 110 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1992 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:41 PM | a4626349-8ea8-0000-8a6d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 109 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 108 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 2320 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 107 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 106 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1936 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 105 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | a4626349-8ea8-0003-146c-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 104 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 103 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 102 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 101 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1104 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:05:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 100 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:04:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 99 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3356 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | a4626349-8ea8-0003-c36b-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 98 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1768 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 97 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 96 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 95 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5960 | 5988 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 94 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 93 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2352 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 92 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 91 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 90 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 89 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 88 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 87 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 86 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 85 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 84 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 83 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 82 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 81 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 80 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 79 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 78 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 77 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 76 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 75 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 74 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 73 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 72 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 71 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 70 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 69 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 68 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 67 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 66 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 65 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 64 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 63 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 62 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 61 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 60 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 59 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 58 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 57 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 56 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 55 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 54 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 53 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 52 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 51 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 50 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 49 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 48 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 47 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 46 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 45 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 44 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 43 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 42 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 41 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 40 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 39 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 38 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 37 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 36 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 35 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 34 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 33 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 32 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 31 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 30 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 29 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 28 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 27 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 26 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 25 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 24 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 23 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 22 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 21 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 20 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 19 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 18 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 17 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 16 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 15 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 14 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 13 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 12 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 11 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 10 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 9 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 8 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 7 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3440 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 6 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 5 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2484 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 4 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 3 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2436 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 2 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 1 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |