Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 857 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 4268 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:59:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 856 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 4268 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:58:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 855 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 4268 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:57:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4616; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 854 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4616 | 4156 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:56:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 853 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:56:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {947484F8-7015-408D-B00C-8853D2977467}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=931280191; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 852 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {04E3C9F7-60DF-4F43-9E21-1F99CA4D4B43}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DC0E291F-B7E6-4882-ABFC-DC060AFE9453}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 851 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F9F33575-3049-4ABC-99EB-6B0FC608580D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1405812804; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 850 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6EBB5344-943F-4283-949F-1AA7CB531CB5}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=189788863; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 849 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B7EA6B5B-28BC-45A4-AC95-AAF1683FD591}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2118034325; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 848 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F501EB1-0F58-4B95-8F4D-6F15C60AFCA1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1250345111; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 847 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AB1E8CC4-6B42-4AFE-AC1A-BC06F7691698}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{71E793F5-3283-4928-BFD0-47A7F2D504E9}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 846 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {314B3943-3795-4445-A250-61EBE5BF3FD2}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=574289942; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 845 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {012535A8-4324-47A0-97AD-A17C66C75895}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1412272160; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 844 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B0D27E75-9CEA-452A-8AE7-3CE8CDDCBBBE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C50C3686-F5E9-4A3E-9592-11CA29921CC0}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 843 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9580E171-5DA6-4C9D-96F3-4BB7B0916A6F}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EE069815-A401-45E0-BE3F-8FC52EA19CA6}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 842 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4EDBC652-EF55-4922-B49A-531AA78685E9}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=233858591; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 841 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D53644EA-D7F5-4C03-9368-C011C647AB11}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2082679101; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 840 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {71917866-E48C-493B-BE08-9B09E3905649}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=860035772; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 839 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:55:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AD337AE6-017F-4FAB-B6C4-3D6214410670}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-129ac199-1b7c-4bde-b50d-51cc54b6fde8"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 838 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:54:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C98180D4-B84D-47ED-95FC-487E44AEC96C}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-129ac199-1b7c-4bde-b50d-51cc54b6fde8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 837 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:54:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 836 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:54:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {42548BE7-CD01-481B-82B3-C4319C29F0DD}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-262245f2-064d-4461-8c0c-f424a4ce5561"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 835 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:53:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C15B6114-8DB5-48A7-9C43-9CF5C0372375}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-262245f2-064d-4461-8c0c-f424a4ce5561",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 834 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:53:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 833 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:53:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 832 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:53:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 831 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 372 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:53:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C7830A27-27E7-401C-B9CC-094B699FCF40}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-55f87246-eb3e-4fb7-b258-18b71cd954ba"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 830 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:52:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E13CCE27-C265-4AE0-BF16-5B2C872FE5D6}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-55f87246-eb3e-4fb7-b258-18b71cd954ba",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 829 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:52:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 828 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 372 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:52:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 827 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:51:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 826 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:51:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 825 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 372 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:51:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {23781494-D127-4F23-A063-8C436235BC47}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=434748577; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 824 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4C14193D-E8E8-432D-98FE-2D695A2D6855}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=482881175; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 823 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {52DFC512-CBE4-42AC-AD6E-F9E722E591C5}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1174206348; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 822 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8B4B62A8-67D7-44A3-9D3A-7E67E8B9AC0D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-809f1cbf-cd36-45aa-a668-731c889c005e"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 821 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {60CC02F9-C3DE-4BC9-9D13-313101A4EF72}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-809f1cbf-cd36-45aa-a668-731c889c005e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 820 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9877C4BD-DAF7-41D1-8027-D867B7987B6B}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-20bf3b63-4165-4d2f-92a3-6f396ee7651c"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 819 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {274C43BA-C83C-4D3C-B7B2-58250B9C82C1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-20bf3b63-4165-4d2f-92a3-6f396ee7651c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 818 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 817 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:50:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7A3E3F75-3A5C-4596-B3C4-70DD8D7AD200}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=403690009; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 816 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C9BA21E7-8823-40AD-8AF4-863A40A66A91}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a6296d00-db00-45b1-af04-7f43918e1c35"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 815 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B03DBF16-6778-4C51-87CA-0DFEDBE61597}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a6296d00-db00-45b1-af04-7f43918e1c35",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 814 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7AF6535B-D37D-4612-9C61-CC844B765A00}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BA9B56B1-784A-4C7A-8606-A2392785E39B}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 813 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A09A5E74-FB0E-4CD6-B23D-E4EFC6479C5B}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1834450655; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 812 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:50:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {17FAE278-A9C4-4ABF-95AB-88A2E35536EC}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-24d6edeb-10cc-45ba-808e-009a2cada230"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 811 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:49:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9FE55F53-0450-4272-AAF3-9C1CA9F95883}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-24d6edeb-10cc-45ba-808e-009a2cada230",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 810 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:49:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 809 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 372 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:49:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 808 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:49:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {62FEB014-953C-45FE-99CE-4C5F4210F9D5}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fe2d86ed-2d68-48dc-bea7-356a74f3d481"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 807 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:48:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9EE495A9-169F-47C8-B14F-902C81D10BD9}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fe2d86ed-2d68-48dc-bea7-356a74f3d481",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 806 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:48:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {95C81E7E-0574-4185-93B3-8F2530F84316}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1311568028; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 805 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:48:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {325ABC12-D2E4-4CA0-A5D1-24CEDCD530EF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1320288809; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 804 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DD88E9F5-F4EF-4B53-8368-9994F7CDE4E0}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-031e5b0f-8d13-46ce-b331-a574912be2b8"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 803 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0E067088-5BDC-411D-A2B9-306F10AE4744}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-031e5b0f-8d13-46ce-b331-a574912be2b8",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 802 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 801 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:47:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {780008EC-43F2-45B7-98A8-F458E85BEFC7}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1130453820; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 800 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DB1241C9-380B-40D4-8D37-FFB537F96522}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-37e9e11b-188c-4cc3-9e38-4e4e5a1cfb89"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 799 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {42F1B686-0AE1-41F6-852B-A37AB0B55D38}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-37e9e11b-188c-4cc3-9e38-4e4e5a1cfb89",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 798 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:47:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1280; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 797 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1280 | 4820 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:47:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 796 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:47:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 795 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:47:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {65921AC6-77A6-4605-9B7F-FD955152D7CD}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2015522906; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 794 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2436 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:46:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8DA93B8F-2CB0-40C9-B36B-02637A9F10C7}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=349505641; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 793 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:46:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {078B359B-5DE6-43CF-9A5C-7B3CD4C4378E}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-a6296d00-db00-45b1-af04-7f43918e1c35"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 792 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2A3A8457-4736-40BF-9042-2C3C79DDCDE9}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-a6296d00-db00-45b1-af04-7f43918e1c35",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 791 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {520BA823-9E03-4AC4-B7D5-4A05F962AA1C}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-37e9e11b-188c-4cc3-9e38-4e4e5a1cfb89"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 790 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2436 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5992A34D-8BE7-4B16-9BB1-6D607BDF6F62}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-37e9e11b-188c-4cc3-9e38-4e4e5a1cfb89",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 789 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 788 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:45:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B4975193-8E6F-4718-ADC6-8963F0A5437A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=798456622; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 787 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F21BB182-60C7-4AED-9244-C03C47CAC1C3}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=248804625; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 786 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9D61086D-3988-45E9-BD6B-E49A15F8B8ED}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{169E1F30-9973-48B2-828D-0065B04DECC7}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 785 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:45:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {43D129E4-CEEA-4D7E-921A-5588BF5DFE7D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1184047119; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 784 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {017B826B-C1B3-404E-8435-35CF42ECBBEB}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=479429229; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 783 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C161A965-4198-4AB6-9DC8-FB3C2FF605A9}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1297666332; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 782 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A2D87083-52BA-476C-91C1-241357F0B388}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{909B18C2-8291-4560-B612-0341937AD202}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 781 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7463F490-095C-4CE0-9D4A-CDE9D9E7D799}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=893075709; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 780 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD2125C9-0FE6-466B-9D4F-96A237FA8120}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{79204FDB-9499-444E-8E4A-B75464DBEC87}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 779 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {474F3CDB-5BCC-4AA7-9103-A8C5F230DA09}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=259689629; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 778 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C0F0D0C6-723D-44AB-90FD-BF0908BA2636}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1884391261; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 777 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:41 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6D25AFE1-5954-489E-82FF-8D0711C90229}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1940142282; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 776 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {980F5BC2-5411-4F16-968C-674D0C269583}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1728812517; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 775 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EEC93694-97BB-4150-9236-87373B8A4AD1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=816828350; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 774 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A6429459-DF8C-4649-9E1D-C5D57A2C3BCF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=254226427; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 773 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {30FC66D3-9023-48FE-A151-0931C7B502EE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-242b3fc2-0394-4aee-9406-d2d23c5d8c5f"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 772 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A84443AA-E2A5-4BBF-8CA2-F3982CD0F73D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-242b3fc2-0394-4aee-9406-d2d23c5d8c5f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 771 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 770 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:44:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {02B0C7C3-9ED5-4557-A389-ABEF1BC6933A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-1b6f1789-7ee0-4afe-8745-467417e27efb"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 769 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1FA441CC-9EF9-4E5A-8525-F4F765836E7F}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-1b6f1789-7ee0-4afe-8745-467417e27efb",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 768 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DE5EA81F-0A30-4C11-B68B-1A154BB1BB9D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5FC1A093-F497-4EDD-9C84-88818566C5B5}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 767 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C82B73C1-F32A-405F-9ED2-F42493324550}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{5F2F4704-5F6E-40C6-803E-8525D167F2F5}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 766 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E3257E78-C42D-4860-9072-34F62B873F06}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{06B1FF58-3FD1-4430-8807-7B80415F2C8C}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 765 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:44:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {483A9DC9-0A4A-4D08-82C9-9E610980D36A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-468bf54e-d173-43cb-a390-646cf393a169"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 764 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6E722604-CFC1-480D-82C2-DDFB153304FE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-468bf54e-d173-43cb-a390-646cf393a169",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 763 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F42F111-3BAF-48A4-A0DA-9D6C6BD3E556}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{83D715B7-40A3-4FE6-B288-8EE8FFDCE007}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 762 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7676311D-E2FD-4CE1-A890-7D765D45DADB}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-f3385c99-9382-4398-ac33-029a86445f32"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 761 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F18755A7-DA88-4C6F-9ABA-46219642A7E1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-f3385c99-9382-4398-ac33-029a86445f32",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 760 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F6229794-3798-4227-B3D7-B7C2E1F9981A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{92F3220D-8960-427D-847C-76A80163510A}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 759 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {41D1ECCB-13BF-45D2-901D-A39E2863C8B1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{29E0AA19-2F35-4B01-8D21-D45AB13F525D}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 758 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E5CBFFAC-2F53-4BFE-A922-D7742C9027AE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AA660EA9-453D-4BA0-824E-027130484C13}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 757 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:43:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 756 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 1148 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:42:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {876E9591-13D4-4FCC-A2BD-9D10160DA42E}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=432901180; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 755 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {58BBCC75-AF84-4CCD-B2FB-F5A0F799AEEA}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D065AECC-0302-4A22-9BCB-320FAD80EA4E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 754 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {997576A2-89B4-4C54-89E4-674B988A0854}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1146615598; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 753 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1D3A1B9E-AC0C-483C-97AE-B7D562EAF006}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1646142018; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 752 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E7810B94-718A-4169-BBD4-130D1C25E542}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=879184203; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 751 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E4C10F08-D0AC-4C05-9EEA-9861EBFA0F43}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=724662717; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 750 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:42:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {20EBB692-ABA7-4091-8A65-A4C6CA92CBB9}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1656621444; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 749 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BD5EA2CE-1D5C-4FE3-9E19-8EC62D08C0D1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1154287287; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 748 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {24E64D18-A3F7-4BA6-96F3-3EB0CF07121A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=790687995; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 747 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3FA68B13-7F1D-46C0-8ECC-E9BC51EA662A}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{841019D9-6A1D-4DFF-AAFD-EB79B4D42A9E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 746 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3900 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4C2808D6-D205-4500-8B8D-627F6A2B0BDA}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=160201221; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 745 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A9F2CBAF-6C0D-4BB2-BD70-BA086BAC023F}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1836281155; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 744 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AEF58623-7DF7-4EF8-B91A-64B304F16D54}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1703401923; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 743 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2B5493CC-E9FD-410C-93AC-59372820A678}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{573C5094-AEF1-478B-9DE7-8A75F8322D3E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 742 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6D530C5D-38E1-4B19-A538-8B661E1E16B2}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=812440501; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 741 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3CBCFBCD-61B2-48B8-AAE7-CD78C19B513E}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=109050302; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 740 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {88390AEC-28E5-4E29-857C-A1296030AC01}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7C87D933-D137-4950-8602-49CAEC646A16}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 739 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1E15C387-7A2E-4F61-8A96-46F98E57A9E3}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{092D4A66-2D0E-4575-A415-E0A6538A3801}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 738 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D712CB24-ED6E-4DC4-B17B-9D975E3939BE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=495278209; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 737 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A013ADE0-27D9-4175-86DF-8E2D1D7D3EAF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F24C846F-539C-463E-9402-A3810A0A8905}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 736 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3900 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B88B1B60-5FAB-41E5-ABF8-09FC6240483D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1380845904; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 735 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {39CC47A8-EB71-42FC-914E-EC43EED5B1C7}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1593804065; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 734 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3972 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D19F528D-0806-4DDB-B750-AB9CA60FC196}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C4F56059-AAC5-4C52-8203-2C2F42B0F8A9}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 733 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3900 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DE52FACB-8285-497C-9849-54FA09E4CBB1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{874AF44C-E099-468E-9B0E-4AD5B032D7D7}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 732 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 496 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2CE14E1D-7A0D-48CE-877B-A2593FCCFB7F}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=323722951; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 731 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C77DFB0-FECD-4536-AFA0-1D5EC2044C0B}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=571521933; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 730 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {960DCE1A-3348-4F86-82B5-28C0F49A60B2}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C5B6436C-2D1B-464A-9FE4-201B69C66D8B}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 729 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D2313D3E-AD8D-4BAB-BCB6-DE738A00A0CF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=665759793; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 728 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0B25F6E3-F86E-4E9F-89DF-63BCEDA1D4BE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=809577725; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 727 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {12EB5A99-D0BA-4B15-9A02-35C81A447471}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1824667587; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 726 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EEEF6476-2E87-47B6-80D3-862F07108460}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1025003925; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 725 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6938203D-2DA2-495D-AD60-166E353D4A5D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=509502949; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 724 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {100AC599-A2E9-4183-9E78-D002D26524BF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2046318103; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 723 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:41:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {60C5CC5C-6358-4921-B3A9-B237D77470A6}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=51116705; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 722 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CE8FE37F-08F2-472A-A60D-A3BC03E6F42B}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=326306162; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 721 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5DFD8980-F6FC-459E-931F-66E127994439}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{610AE807-B4EE-4EFC-9B09-1D55C7EC9A82}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 720 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {47B1E6B0-F633-4B07-A3D9-37F19F41FD96}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1437580656; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 719 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C06B6AFB-2515-4E11-99E0-3F3C26465494}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=718957985; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 718 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9FDCE066-D8B6-44BC-B7A7-1BE90D3F12EE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1266594130; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 717 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2320CEDA-53AE-4637-A755-F7AD1CB2FB26}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=110763866; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 716 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {21C24C42-9AB7-41A4-B5F0-2BBAD0AB54C6}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1585826059; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 715 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {81E7BAA6-2EDD-4F25-8560-46E137670791}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=411321959; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 714 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {760B0D6C-6D46-4864-AFE3-6163C1BAA818}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=431249842; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 713 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:41 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DDB01697-0602-449E-AEAA-5CC009E32764}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=921459019; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 712 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {15860170-E1BC-47AE-835A-454526C269BB}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=331173914; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 711 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7BCCFD7A-E2AA-429E-9872-0BE402AA732C}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1743465576; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 710 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8977365C-41D4-442A-9D78-FC0D870A0A79}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1891218873; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 709 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C075B995-52AC-441A-AF62-539850649520}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-6a5c6f53-df4c-4d39-86eb-58fba9482cb1"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 708 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1C046F33-4D70-4796-96B0-BA4B3286C852}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-6a5c6f53-df4c-4d39-86eb-58fba9482cb1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-77957"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 707 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {292B63E4-4032-459B-A203-129707EC7C66}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=991201510; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 706 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D78DDAC9-4747-471D-BF37-EA2715BFC137}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=228630246; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 705 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6F855E71-3843-47C3-A872-9CB00508E3A0}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1686395410; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 704 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1B41AE72-7AD4-4453-834F-7580863B188D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6C62E5D9-AFD9-4825-B59D-8EEB21EBB811}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 703 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F3B71EEC-7BDA-4B46-9170-85263B594B71}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1372253440; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 702 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4728 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D7B4A622-2916-45D6-9E0F-6D3F7DEA3171}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DEB53891-BF6E-4641-BACE-2E7429C63A42}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 701 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 700 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:40:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9CC05370-2C02-4DA0-903D-332B87505EC8}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{4BB19858-6F97-4232-9B92-5B29F5F873E0}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 699 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {259342A7-B157-44F4-921C-0BA2C2EB2CE0}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=504220286; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 698 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {224B9306-8E54-4C21-997E-8B5A6CC7231E}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1132277019; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 697 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E75F4DFA-5124-4035-B330-629F54AD1DD5}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1297952702; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 696 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AB3B5FF1-6B65-48F4-94E7-21BB1F3560A6}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1091266975; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 695 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6B9DBEAF-8F6E-494F-9924-9937ECEC2A8B}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{382785FB-E373-43BE-91D9-834C045D0FDB}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 694 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3064 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8E272557-417F-49FE-9836-B2F2B3713742}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=397931083; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 693 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {50F813CC-7394-4B6E-83E4-BBEE4C4B1780}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{63518DAE-A474-4DDC-A467-797F05C77FD8}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 692 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 4012 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {66A9FD99-58E0-4436-9150-2829D52C583F}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{FF8A8E9C-6E56-4E29-B23F-540E0388BC81}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 691 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {36EC9E67-4223-4B61-A502-167F5F513CA1}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1187995857; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 690 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B48B5966-DD4F-40A0-B5CD-816D450CA520}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=283494157; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 689 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 496 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BC405786-559C-4B8C-B24A-10D8C3518FE4}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{18C873CD-E50E-4137-BA44-FCB126152FC9}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 688 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5B7BA93E-DD73-4520-A091-DA9589E2ABFD}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1096558405; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 687 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 496 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3596CA90-7DD2-4B76-98FA-9477007E3EAF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1819989147; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 686 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3A23ADBF-13A5-48CC-B0F0-6480305AF0FF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1888337340; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 685 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:40:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A2302A16-E6EF-47EE-9979-BE3F715C93D6}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F92A5526-E7E2-4997-92BF-EF3162D7C63E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 684 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8CA163E3-AD8A-4160-A860-06860E0C119C}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6DF74C16-0BE5-49AB-BAB8-49102D9C320B}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 683 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1732 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {85662092-61F7-4C36-9644-710F2D863813}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2121929889; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 682 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 496 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {925A8290-7C70-45FC-939A-31EBB31A9164}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=100934917; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 681 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2436 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {94FCFBB3-EC50-44DA-B36F-2C909FBF8C7E}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1890720266; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 680 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {90974140-F9D9-48EB-9659-571052A87105}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=49774980; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 679 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2384 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AA6FBF6E-AFD2-468E-BD56-73A728FDE429}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1466140387; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 678 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {743FE842-2645-404A-B1E3-3CBE29BB19AF}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1941135645; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 677 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {162C3039-75B7-466B-99E2-3A665E21E6D5}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=932389041; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 676 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4951353A-3D1B-443B-A7E6-2C48D9FA209D}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{6AD327BF-5C46-463D-AD7E-D9D01142B889}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 675 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {48B5767B-2391-40FA-AA51-CB0718E973DE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{79006EF4-65DA-4FA5-8C36-4A2720F049FC}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 674 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {727461D4-B7A5-4E2C-A086-60EB3E305D9C}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=516255551; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 673 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A2BD0035-069F-406E-9473-6395C4F5A986}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1612394786; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 672 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2180 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {94AEA8CA-3400-4926-B20B-9B65D58C1A31}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2044400473; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 671 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2436 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B0F48FB6-421B-4AD1-BCC0-C63F303201BE}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=896193285; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 670 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DB3943E1-7621-4BDC-B4CF-C5D8CC237805}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1692233607; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 669 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D8939AB2-6FC3-4CE6-84BB-A6A60D4FF7E8}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1850042277; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 668 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1852 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {19197539-8730-480D-811E-E821058BDF32}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 5052; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1298772628; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 667 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 824 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:39:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 666 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 4584 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:39:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 665 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:39:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1280; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 664 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1280 | 4820 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:39:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 663 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:38:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1188, ClientMachine = HV-CINDER-77957; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 662 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1328 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:37:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1188, ClientMachine = HV-CINDER-77957; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 661 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1328 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:37:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4736, ClientMachine = HV-CINDER-77957; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 660 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 1328 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:37:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5104; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 659 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5104 | 1944 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:37:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4408; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 658 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4408 | 584 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:37:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 657 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:37:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4552; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 656 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4552 | 3796 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:36:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 655 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:36:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4380; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 654 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4380 | 2412 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:36:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1644; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 653 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1644 | 4164 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:25:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4092; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 652 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4092 | 1292 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:24:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4092; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 651 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4092 | 188 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:24:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4092; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 650 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4092 | 1292 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:24:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3820; ProviderPath = %systemroot%\system32\wbem\msiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 649 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3820 | 3848 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:08:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 648 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3044 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {058B7B8F-B7D3-0002-2A7E-8B05D3B7D801}; ClientMachine = HV-CINDER-77957; User = HV-CINDER-77957\Admin; ClientProcessId = 2500; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 647 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 500 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {058B7B8F-B7D3-0002-2A7E-8B05D3B7D801}; ClientMachine = HV-CINDER-77957; User = HV-CINDER-77957\Admin; ClientProcessId = 2500; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 646 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3524 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {058B7B8F-B7D3-0002-2A7E-8B05D3B7D801}; ClientMachine = HV-CINDER-77957; User = HV-CINDER-77957\Admin; ClientProcessId = 2500; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 645 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3524 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-77957\Admin; ClientProcessID = 2500, ClientMachine = HV-CINDER-77957; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 644 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3524 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-77957\Admin; ClientProcessID = 2500, ClientMachine = HV-CINDER-77957; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 643 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3524 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 642 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3816 | 2788 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:05:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 641 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3044 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:05:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2092; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 640 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2092 | 3912 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:05:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1720; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 639 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1720 | 2524 | hv-cinder-77957 | S-1-5-19 | 8/24/2022 4:05:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3820; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 638 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3820 | 3848 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:05:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2092; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 637 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2092 | 3508 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:05:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 636 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3044 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:05:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\wfascim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 635 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 2564 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:05:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3952; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 634 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3952 | 1280 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 633 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3044 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:04:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2612; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 632 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3620 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2612; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 631 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3620 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3820; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 630 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3820 | 3848 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = HV-CINDER-77957\cloudbase-init; ClientProcessId = 3220; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 629 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %SystemRoot%\System32\sppwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 628 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3040 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:04:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 627 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2904 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 626 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 625 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 624 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 2564 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 623 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 622 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 621 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 620 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2244 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 619 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3068 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 618 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3716 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 617 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2904 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 616 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 2564 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:04:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 615 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2904 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 614 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2904 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3144; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 613 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3068 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:04:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3952; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 612 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3952 | 676 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 611 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3040 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:03:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 610 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 609 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 608 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 607 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 606 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 605 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 604 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 603 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 602 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 601 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 600 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 599 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 598 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 597 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 596 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 595 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 594 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 593 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 592 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 591 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 590 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 589 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 588 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 587 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 586 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 585 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 584 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 583 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 582 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 581 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 580 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 579 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 578 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 577 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 576 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 575 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 574 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 573 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 572 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 571 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 570 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 569 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 568 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 567 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 566 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F80D866-10D6-43FF-8E34-8DC6DB80436F}; ClientMachine = HV-CINDER-77957; User = ; ClientProcessId = 560; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 565 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 560; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 564 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3200 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:47 PM | 058b7b8f-b7d3-0001-e27b-8b05d3b7d801 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 563 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2964 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 562 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 3168 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3820; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 561 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3820 | 3848 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3820; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 560 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3820 | 3848 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 559 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3040 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:03:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3008; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 558 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3008 | 3044 | hv-cinder-77957 | S-1-5-20 | 8/24/2022 4:03:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2588; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 557 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2976 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-77957; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1800; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_2861951206_1637630421_3747571899_500"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 556 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 560 | 2968 | hv-cinder-77957 | S-1-5-18 | 8/24/2022 4:03:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-IBOF953O3VR; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2812; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 555 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2228 | WIN-5T344G8GM1H | S-1-5-18 | 8/24/2022 4:03:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-IBOF953O3VR; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2812; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 554 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2228 | WIN-5T344G8GM1H | S-1-5-18 | 8/24/2022 4:03:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-IBOF953O3VR; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2120; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 553 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2536 | WIN-5T344G8GM1H | S-1-5-18 | 8/24/2022 4:02:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-IBOF953O3VR; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1736; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 552 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 528 | 2496 | WIN-5T344G8GM1H | S-1-5-18 | 8/24/2022 4:02:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 551 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 550 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 549 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 548 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 547 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4848 | 4776 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:45:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 546 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 1176 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll" | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 545 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 544 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 543 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 542 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 541 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 540 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 539 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 538 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 537 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:43 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 536 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 535 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 534 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 533 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2172 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | ad8d0f9c-9109-0001-0a10-8dad0991d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 532 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 531 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 388 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 530 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 529 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 528 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 527 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 526 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 525 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 524 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 523 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 522 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 521 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 520 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 519 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 518 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 517 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 516 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 515 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 514 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 513 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 512 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 511 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 510 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 509 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 508 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 507 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 506 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 505 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 504 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 503 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 502 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 501 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 500 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 499 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 498 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 497 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 496 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 495 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 494 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 493 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 492 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 491 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 490 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 489 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 488 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 487 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 486 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 485 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 484 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2848 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 483 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2692 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 482 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 1548 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:40:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 481 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 480 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 479 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 478 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 477 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 476 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 475 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 474 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 473 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 472 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 471 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 470 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 2924 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 469 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4444 | 4516 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 468 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 467 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 466 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 465 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 464 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1548 | 2160 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 463 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 462 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 461 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 764 | 1020 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:33:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 460 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 459 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 458 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:31:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 457 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 456 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 455 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2716 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 454 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 453 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4608 | 4636 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 452 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2896 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 451 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4344 | 4368 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 450 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:25 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 449 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 448 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:19 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 447 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | aff0bd57-9107-0002-9bbd-f0af0791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 446 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 445 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 444 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 443 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 442 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 441 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 440 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 439 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 438 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 437 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 436 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 435 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 434 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 433 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 432 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 431 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 430 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 429 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 428 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 427 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 426 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 425 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 424 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 423 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 422 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 421 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 420 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 419 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 418 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 417 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 416 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 415 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 414 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 413 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 412 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 411 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 410 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 409 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 408 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 407 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 406 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 405 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 404 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 403 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 402 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 401 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 400 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 399 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 398 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 397 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 396 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 395 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 394 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 393 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 392 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 391 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 390 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 389 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 388 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 387 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 386 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 385 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 384 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 383 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 382 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 381 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 380 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 379 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 378 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 377 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 376 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 375 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 374 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 373 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 372 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 371 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 370 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 369 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 368 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 367 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 366 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 365 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 364 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 363 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 362 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 361 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 360 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 359 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 358 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 357 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 356 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 355 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 354 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 353 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 352 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 351 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 350 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 349 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 348 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 347 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 346 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 345 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 344 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 343 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 342 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 341 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 340 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 339 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 338 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 337 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 336 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 335 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 334 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 333 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 332 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 331 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 330 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 329 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 328 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 327 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | 96ed06e7-9107-0000-3d07-ed960791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 326 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 325 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 324 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 323 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 322 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 321 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 320 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 319 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 318 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 317 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 316 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 315 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 314 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 313 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 312 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 311 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 310 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 309 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 308 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 307 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 306 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 305 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 304 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 303 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 302 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 301 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 300 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 299 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 298 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 297 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 296 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 295 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 294 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 293 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2864 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:42 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 292 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2620 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 291 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 290 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2528 | 3456 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:24:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 289 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 288 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 3804 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 287 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 286 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 285 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3200 | 3644 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 284 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2920 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 283 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2540 | 3240 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 282 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 281 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 280 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 279 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2916 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | 17f2f0cc-9107-0002-12f1-f2170791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 278 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2908 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 277 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 276 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3808 | 4032 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:14:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 275 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 274 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2972 | 156 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 273 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 272 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 1584 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 271 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4136 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:11:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 270 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4368 | 4496 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:10:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 269 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1784 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:05:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 268 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 267 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 1396 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 266 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 265 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 1000 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 264 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 3364 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:58:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 263 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 262 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 261 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 260 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 259 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | 289cfce6-9103-0003-f9fd-9c280391d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 258 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 257 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:06 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 256 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 255 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:55:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 254 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4020 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 253 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 4052 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 252 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 251 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 3996 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 250 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3880 | 3916 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 249 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 3004 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:34 AM | 7c5c4ffb-9102-0000-4a51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 248 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1200 | 2840 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 247 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | 7c5c4ffb-9102-0001-8851-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 246 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 245 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | 7c5c4ffb-9102-0001-5f51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 244 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 243 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3932 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 242 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:37 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 241 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 428 | 1316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 240 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 239 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3888 | 3916 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 238 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 237 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3860 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 236 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4796 | 840 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:45:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 235 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2284 | 2676 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:44:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 234 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 233 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2300 | 4360 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 232 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 231 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 3736 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 230 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1052 | 4868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:36:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 229 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3184 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 228 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 4616 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 227 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 226 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 225 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 224 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 223 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 222 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 221 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2920 | 4532 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 220 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 219 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 218 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4228 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:15 AM | 9a81cb05-910f-0003-8acc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 217 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 216 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 215 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 214 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 213 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 212 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 211 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 210 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 209 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 208 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 207 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 2868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 206 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1912 | 3084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 205 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 204 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 203 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 202 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4324 | 3568 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:27:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 201 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | 9a81cb05-910f-0000-a4cc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 200 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 199 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 198 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:25:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 197 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | 9a81cb05-910f-0003-4bcc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 196 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 195 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 194 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4124 | 4152 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 193 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3820 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 192 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3084 | 3436 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 191 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 190 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 189 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 188 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 3176 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:37:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 187 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 186 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2788 | 2624 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 185 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 184 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2440 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 183 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 3868 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:27:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 182 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 181 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1500 | 2664 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 180 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 179 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 4056 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 178 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 652 | 1972 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:17:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 177 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 3152 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 176 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3124 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 175 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1184 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 174 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1160 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 173 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1088 | 4088 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:10:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 172 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 171 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | b65c0852-8ef4-0003-8709-5cb6f48ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 170 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 169 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 168 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 167 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4072 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 166 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4076 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 165 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4060 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 164 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 163 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 162 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 161 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 160 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 159 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 158 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 157 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 156 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 155 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 154 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 153 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 152 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 151 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 150 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2832 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 149 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 148 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4892 | 836 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:02:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 147 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4256 | 4144 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:53:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 146 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 145 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5092 | 2628 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 144 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 143 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 5116 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 142 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4780 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:50:11 PM | 53b2b737-8ef1-0000-6db9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 141 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 2160 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:46:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 140 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | 53b2b737-8ef1-0003-feb9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 139 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 138 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 137 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4212 | 4236 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 136 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2796 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 135 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3216 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 134 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3208 | 3308 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 133 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 132 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 131 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 130 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | 53b2b737-8ef1-0001-8eb7-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 129 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 128 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:37:24 PM | a4626349-8ea8-0003-b36d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 127 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 164 | 3628 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:35:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 126 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:35:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 125 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 428 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 124 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 5928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 123 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | a4626349-8ea8-0002-ed6e-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 122 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 121 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5028 | 5328 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:32:53 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 120 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 119 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3816 | 1224 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 118 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 117 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 912 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 116 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3180 | 804 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:22:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 115 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 114 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 888 | 5288 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 113 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 112 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 111 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5964 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 110 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1992 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:41 PM | a4626349-8ea8-0000-8a6d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 109 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 108 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 2320 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 107 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 106 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1936 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 105 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | a4626349-8ea8-0003-146c-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 104 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 103 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 102 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 101 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1104 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:05:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 100 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:04:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 99 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3356 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | a4626349-8ea8-0003-c36b-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 98 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1768 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 97 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 96 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 95 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5960 | 5988 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 94 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 93 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2352 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 92 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 91 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 90 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 89 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 88 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 87 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 86 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 85 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 84 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 83 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 82 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 81 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 80 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 79 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 78 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 77 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 76 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 75 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 74 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 73 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 72 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 71 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 70 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 69 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 68 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 67 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 66 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 65 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 64 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 63 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 62 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 61 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 60 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 59 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 58 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 57 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 56 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 55 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 54 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 53 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 52 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 51 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 50 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 49 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 48 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 47 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 46 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 45 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 44 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 43 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 42 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 41 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 40 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 39 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 38 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 37 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 36 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 35 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 34 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 33 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 32 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 31 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 30 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 29 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 28 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 27 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 26 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 25 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 24 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 23 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 22 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 21 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 20 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 19 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 18 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 17 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 16 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 15 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 14 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 13 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 12 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 11 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 10 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 9 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 8 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 7 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3440 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 6 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 5 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2484 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 4 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 3 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2436 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 2 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 1 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |