Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	1018	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	4024	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:26 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	1017	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:14 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	1016	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3736	4760	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:12 PM	ac2ce96e-3614-0000-7f3c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	1015	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3736	4760	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:12 PM	ac2ce96e-3614-0000-7f3c-31ac1436d701	ac2ce96e-3614-0000-813c-31ac1436d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	1014	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3736	2892	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:12 PM	ac2ce96e-3614-0000-813c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	1013	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3736	4760	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:12 PM	ac2ce96e-3614-0000-7f3c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	1012	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	3736	2892	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:12 PM	ac2ce96e-3614-0000-7f3c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	1011	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1968	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:33:07 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	1010	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	1009	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:42 PM	ac2ce96e-3614-0000-d93b-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	1008	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:42 PM	ac2ce96e-3614-0000-d93b-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	1007	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4372	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	1006	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	1005	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	1004	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	1003	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM	ac2ce96e-3614-0002-b1f4-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	1002	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM	ac2ce96e-3614-0002-b1f4-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	1001	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	1000	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	999	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM	ac2ce96e-3614-0002-9ef4-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	998	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM	ac2ce96e-3614-0002-9ef4-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	997	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	996	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	995	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	994	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:34 PM	ac2ce96e-3614-0003-f467-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	993	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:34 PM	ac2ce96e-3614-0003-f467-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	992	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	991	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	990	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:33 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	989	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:33 PM	ac2ce96e-3614-0004-5f1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	988	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:33 PM	ac2ce96e-3614-0004-5f1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	987	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:33 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	986	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:33 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	985	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	984	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	983	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM	ac2ce96e-3614-0004-3e1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	982	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM	ac2ce96e-3614-0004-3e1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	981	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	980	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	979	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:31 PM	ac2ce96e-3614-0004-2a1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	978	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:31 PM	ac2ce96e-3614-0004-2a1a-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	977	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	976	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:32:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	975	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:30:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	974	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:30:31 PM	ac2ce96e-3614-0005-7c55-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	973	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1824	hv-cinder-78693	S-1-5-18	4/20/2021 7:30:31 PM	ac2ce96e-3614-0005-7c55-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	972	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:30:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	971	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:30:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	970	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	969	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	968	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM	ac2ce96e-3614-0003-613f-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	967	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM	ac2ce96e-3614-0003-613f-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	966	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	965	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	964	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM	ac2ce96e-3614-0003-4e3f-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	963	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM	ac2ce96e-3614-0003-4e3f-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	962	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	961	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:28:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	960	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	959	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:48 PM	ac2ce96e-3614-0003-5232-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	958	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:48 PM	ac2ce96e-3614-0003-5232-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	957	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	956	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	955	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	954	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:47 PM	ac2ce96e-3614-0004-5ee2-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	953	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:47 PM	ac2ce96e-3614-0004-5ee2-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	952	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	951	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	950	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	949	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM	ac2ce96e-3614-0003-9530-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	948	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM	ac2ce96e-3614-0003-9530-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	947	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	946	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	945	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	944	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	943	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM	ac2ce96e-3614-0001-e1bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	942	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM	ac2ce96e-3614-0001-e1bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	941	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	940	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	939	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	938	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	937	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0003-282d-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	936	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0003-282d-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	935	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	934	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	933	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0001-33bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	932	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0001-33bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	931	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	930	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	929	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0002-47a9-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	928	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM	ac2ce96e-3614-0002-47a9-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	927	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	926	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	925	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	924	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:34 PM	ac2ce96e-3614-0000-e05d-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	923	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:34 PM	ac2ce96e-3614-0000-e05d-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	922	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	921	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	920	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	919	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	918	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM	ac2ce96e-3614-0002-96a3-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	917	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM	ac2ce96e-3614-0002-96a3-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	916	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	915	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	914	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM	ac2ce96e-3614-0001-4fb3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	913	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM	ac2ce96e-3614-0001-4fb3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	912	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4372	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	911	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	910	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	909	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:09 PM	ac2ce96e-3614-0001-27b3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	908	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:09 PM	ac2ce96e-3614-0001-27b3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	907	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	906	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	905	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:00 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	904	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:00 PM	ac2ce96e-3614-0000-015a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	903	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:00 PM	ac2ce96e-3614-0000-015a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	902	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:00 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	901	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:26:00 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	900	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	899	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:47 PM	ac2ce96e-3614-0005-a132-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	898	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:47 PM	ac2ce96e-3614-0005-a132-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	897	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	896	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	895	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	894	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:45 PM	ac2ce96e-3614-0000-0b32-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	893	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:45 PM	ac2ce96e-3614-0000-0b32-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	892	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	891	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	890	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	889	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:44 PM	ac2ce96e-3614-0001-b6a3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	888	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:44 PM	ac2ce96e-3614-0001-b6a3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	887	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	886	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	885	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	884	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:38 PM	ac2ce96e-3614-0004-4bcb-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	883	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:38 PM	ac2ce96e-3614-0004-4bcb-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	882	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	881	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	880	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	879	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:13 PM	ac2ce96e-3614-0004-dbc3-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	878	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:13 PM	ac2ce96e-3614-0004-dbc3-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	877	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	876	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	875	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	874	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	873	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM	ac2ce96e-3614-0001-6b66-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	872	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM	ac2ce96e-3614-0001-6b66-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	871	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	870	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	869	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM	ac2ce96e-3614-0001-5b66-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	868	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM	ac2ce96e-3614-0001-5b66-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	867	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	866	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:25:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	865	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	864	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:51 PM	ac2ce96e-3614-0000-60b1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	863	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:51 PM	ac2ce96e-3614-0000-60b1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	862	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	861	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	860	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	859	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:49 PM	ac2ce96e-3614-0004-33c3-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	858	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:49 PM	ac2ce96e-3614-0004-33c3-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	857	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	856	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	855	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	854	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:48 PM	ac2ce96e-3614-0000-55b1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	853	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:48 PM	ac2ce96e-3614-0000-55b1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	852	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4372	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	851	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	850	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	849	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	848	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM	ac2ce96e-3614-0003-5a0c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	847	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM	ac2ce96e-3614-0003-5a0c-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	846	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4388	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	845	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	844	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM	ac2ce96e-3614-0004-dec2-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	843	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM	ac2ce96e-3614-0004-dec2-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	842	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	841	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:39 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	840	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	839	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	838	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM	ac2ce96e-3614-0002-ba57-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	837	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM	ac2ce96e-3614-0002-ba57-34ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	836	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	835	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	834	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM	ac2ce96e-3614-0001-d45d-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	833	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM	ac2ce96e-3614-0001-d45d-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	832	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	831	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:24:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	830	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	829	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM	ac2ce96e-3614-0004-43b6-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	828	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM	ac2ce96e-3614-0004-43b6-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	827	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	826	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	825	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	824	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	823	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM	ac2ce96e-3614-0005-f748-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	822	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM	ac2ce96e-3614-0005-f748-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	821	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	820	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	819	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM	ac2ce96e-3614-0005-b948-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	818	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM	ac2ce96e-3614-0005-b948-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	817	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	816	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	815	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	814	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:47 PM	ac2ce96e-3614-0004-5ca4-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	813	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:47 PM	ac2ce96e-3614-0004-5ca4-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	812	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	811	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	810	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	809	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:45 PM	ac2ce96e-3614-0001-394e-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	808	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:45 PM	ac2ce96e-3614-0001-394e-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	807	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	806	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	805	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	804	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:36 PM	ac2ce96e-3614-0002-a4df-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	803	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:36 PM	ac2ce96e-3614-0002-a4df-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	802	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	801	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	800	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:17 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	799	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:16 PM	ac2ce96e-3614-0005-5a2a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	798	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:16 PM	ac2ce96e-3614-0005-5a2a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	797	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	796	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	795	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	794	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:15 PM	ac2ce96e-3614-0000-9b07-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	793	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:15 PM	ac2ce96e-3614-0000-9b07-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	792	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	791	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	790	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	789	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:13 PM	ac2ce96e-3614-0005-4627-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	788	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:13 PM	ac2ce96e-3614-0005-4627-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	787	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4572	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	786	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	785	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	784	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:12 PM	ac2ce96e-3614-0000-c0f7-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	783	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:12 PM	ac2ce96e-3614-0000-c0f7-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	782	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	781	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:12 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	780	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	779	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:11 PM	ac2ce96e-3614-0001-a914-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	778	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:11 PM	ac2ce96e-3614-0001-a914-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	777	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	776	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	775	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	774	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	773	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM	ac2ce96e-3614-0004-0487-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	772	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM	ac2ce96e-3614-0004-0487-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	771	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	770	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	769	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM	ac2ce96e-3614-0004-ea86-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	768	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM	ac2ce96e-3614-0004-ea86-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	767	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	766	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	765	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	764	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM	ac2ce96e-3614-0004-c486-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	763	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM	ac2ce96e-3614-0004-c486-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	762	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4388	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	761	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:09 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	760	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	759	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM	ac2ce96e-3614-0005-b423-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	758	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM	ac2ce96e-3614-0005-b423-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	757	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	756	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	755	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	754	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM	ac2ce96e-3614-0000-0ef5-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	753	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM	ac2ce96e-3614-0000-0ef5-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	752	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	751	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	750	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	749	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:07 PM	ac2ce96e-3614-0005-6323-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	748	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:07 PM	ac2ce96e-3614-0005-6323-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	747	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	746	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:23:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	745	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	744	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:59 PM	ac2ce96e-3614-0000-beeb-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	743	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:59 PM	ac2ce96e-3614-0000-beeb-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	742	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	741	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	740	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	739	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	738	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM	ac2ce96e-3614-0001-c508-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	737	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM	ac2ce96e-3614-0001-c508-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	736	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	735	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	734	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM	ac2ce96e-3614-0000-67ea-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	733	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM	ac2ce96e-3614-0000-67ea-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	732	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	731	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	730	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	729	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:53 PM	ac2ce96e-3614-0002-c120-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	728	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:53 PM	ac2ce96e-3614-0002-c120-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	727	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	726	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:53 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	725	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	724	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:51 PM	ac2ce96e-3614-0005-700f-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	723	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:51 PM	ac2ce96e-3614-0005-700f-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	722	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	721	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:51 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	720	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	719	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	718	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0000-c1dc-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	717	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0000-c1dc-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	716	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	715	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	714	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0004-7d4e-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	713	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0004-7d4e-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	712	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	711	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	710	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	709	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0002-9e03-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	708	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM	ac2ce96e-3614-0002-9e03-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	707	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	706	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	705	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	704	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM	ac2ce96e-3614-0004-ad4d-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	703	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM	ac2ce96e-3614-0004-ad4d-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	702	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	701	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	700	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	699	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM	ac2ce96e-3614-0002-e201-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	698	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:44 PM	ac2ce96e-3614-0002-e201-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	697	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	696	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	695	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	694	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM	ac2ce96e-3614-0000-3cd9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	693	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM	ac2ce96e-3614-0000-3cd9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	692	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	691	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	690	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	689	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM	ac2ce96e-3614-0002-2b00-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	688	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM	ac2ce96e-3614-0002-2b00-32ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	687	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	686	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	685	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	684	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0001-70fc-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	683	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0001-70fc-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	682	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	681	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	680	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	679	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0002-c9fe-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	678	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0002-c9fe-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	677	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	676	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	675	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	674	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	673	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0002-44fe-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	672	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM	ac2ce96e-3614-0002-44fe-31ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	671	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	670	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	669	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM	ac2ce96e-3614-0004-8e4a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	668	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM	ac2ce96e-3614-0004-8e4a-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	667	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	666	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	665	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	664	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM	ac2ce96e-3614-0003-0843-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	663	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM	ac2ce96e-3614-0003-0843-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	662	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	661	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	660	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	659	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:37 PM	ac2ce96e-3614-0001-17f6-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	658	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:37 PM	ac2ce96e-3614-0001-17f6-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	657	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	656	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	655	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	654	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM	ac2ce96e-3614-0005-a0e1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	653	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM	ac2ce96e-3614-0005-a0e1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	652	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	651	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	650	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	649	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM	ac2ce96e-3614-0004-e324-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	648	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM	ac2ce96e-3614-0004-e324-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	647	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	646	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	645	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:25 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	644	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:25 PM	ac2ce96e-3614-0001-c1e1-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	643	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:25 PM	ac2ce96e-3614-0001-c1e1-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	642	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:25 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	641	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:22:25 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	640	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	639	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	638	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM	ac2ce96e-3614-0000-a15d-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	637	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM	ac2ce96e-3614-0000-a15d-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	636	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	635	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	634	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM	ac2ce96e-3614-0005-28a3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	633	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM	ac2ce96e-3614-0005-28a3-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	632	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	631	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	630	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	629	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM	ac2ce96e-3614-0005-fda2-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	628	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM	ac2ce96e-3614-0005-fda2-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	627	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	626	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	625	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	624	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM	ac2ce96e-3614-0001-b8a9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	623	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM	ac2ce96e-3614-0001-b8a9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	622	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4388	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	621	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:55 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	620	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	619	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:42 PM	ac2ce96e-3614-0005-4c94-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	618	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:42 PM	ac2ce96e-3614-0005-4c94-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	617	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	616	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	615	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	614	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:34 PM	ac2ce96e-3614-0001-148f-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	613	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:34 PM	ac2ce96e-3614-0001-148f-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	612	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	611	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	610	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	609	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:32 PM	ac2ce96e-3614-0003-a00f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	608	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:32 PM	ac2ce96e-3614-0003-a00f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	607	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	606	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	605	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	604	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM	ac2ce96e-3614-0003-110f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	603	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM	ac2ce96e-3614-0003-110f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	602	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	601	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	600	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	599	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM	ac2ce96e-3614-0004-bdc8-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	598	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM	ac2ce96e-3614-0004-bdc8-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	597	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	596	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	595	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	594	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0004-24c8-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	593	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0004-24c8-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	592	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	591	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	590	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	589	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	588	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0005-2a83-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	587	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0005-2a83-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	586	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	585	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	584	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0003-240c-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	583	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM	ac2ce96e-3614-0003-240c-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	582	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	581	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:30 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	580	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	579	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	578	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM	ac2ce96e-3614-0004-37c1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	577	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM	ac2ce96e-3614-0004-37c1-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	576	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	575	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	574	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:28 PM	ac2ce96e-3614-0004-f9c0-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	573	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:28 PM	ac2ce96e-3614-0004-f9c0-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	572	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4572	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:28 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	571	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:28 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	570	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	569	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM	ac2ce96e-3614-0003-9af8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	568	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM	ac2ce96e-3614-0003-9af8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	567	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	566	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	565	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	564	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM	ac2ce96e-3614-0002-32a6-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	563	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM	ac2ce96e-3614-0002-32a6-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	562	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	561	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	560	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	559	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM	ac2ce96e-3614-0001-c484-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	558	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM	ac2ce96e-3614-0001-c484-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	557	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4388	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	556	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	555	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	554	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM	ac2ce96e-3614-0003-69f8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	553	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:15 PM	ac2ce96e-3614-0003-69f8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	552	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	551	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	550	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	549	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM	ac2ce96e-3614-0003-39f8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	548	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM	ac2ce96e-3614-0003-39f8-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	547	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	546	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	545	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	544	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM	ac2ce96e-3614-0004-45b5-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	543	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM	ac2ce96e-3614-0004-45b5-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	542	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	541	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:14 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	540	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	539	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM	ac2ce96e-3614-0002-4fa5-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	538	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM	ac2ce96e-3614-0002-4fa5-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	537	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	536	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	535	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	534	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM	ac2ce96e-3614-0004-e6b4-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	533	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM	ac2ce96e-3614-0004-e6b4-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	532	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	531	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:21:13 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	530	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	529	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:45 PM	ac2ce96e-3614-0000-de04-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	528	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:45 PM	ac2ce96e-3614-0000-de04-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	527	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	526	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	525	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	524	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:43 PM	ac2ce96e-3614-0003-53e1-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	523	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:43 PM	ac2ce96e-3614-0003-53e1-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	522	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4572	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	521	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	520	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	519	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0002-d37b-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	518	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0002-d37b-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	517	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	516	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	515	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	514	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	513	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0004-7f6f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	512	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0004-7f6f-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	511	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	510	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	509	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0002-027b-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	508	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM	ac2ce96e-3614-0002-027b-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	507	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	506	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	505	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	504	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:34 PM	ac2ce96e-3614-0003-56cf-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	503	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:34 PM	ac2ce96e-3614-0003-56cf-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	502	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	501	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:34 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	500	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	499	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:32 PM	ac2ce96e-3614-0003-2aba-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	498	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:32 PM	ac2ce96e-3614-0003-2aba-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	497	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	496	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:32 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	495	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	494	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	493	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0004-4a31-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	492	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0004-4a31-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	491	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	490	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	489	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0002-af5c-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	488	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0002-af5c-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	487	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3976	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	486	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	485	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	484	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0001-5e3a-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	483	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM	ac2ce96e-3614-0001-5e3a-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	482	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	481	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	480	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:27 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	479	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:27 PM	ac2ce96e-3614-0000-0ee6-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	478	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:27 PM	ac2ce96e-3614-0000-0ee6-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	477	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:27 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	476	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:27 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	475	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	474	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM	ac2ce96e-3614-0001-c023-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	473	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM	ac2ce96e-3614-0001-c023-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	472	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	471	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	470	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:23 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	469	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:22 PM	ac2ce96e-3614-0005-f264-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	468	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:22 PM	ac2ce96e-3614-0005-f264-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	467	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:22 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	466	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:22 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	465	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	464	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:21 PM	ac2ce96e-3614-0004-d414-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	463	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:21 PM	ac2ce96e-3614-0004-d414-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	462	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	461	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	460	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:18 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	459	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:18 PM	ac2ce96e-3614-0004-1910-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	458	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:18 PM	ac2ce96e-3614-0004-1910-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	457	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:18 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	456	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:18 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	455	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	454	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:16 PM	ac2ce96e-3614-0005-0053-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	453	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:16 PM	ac2ce96e-3614-0005-0053-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	452	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	451	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	450	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	449	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:15 PM	ac2ce96e-3614-0005-8b50-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	448	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:15 PM	ac2ce96e-3614-0005-8b50-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	447	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	446	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:15 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	445	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	444	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:08 PM	ac2ce96e-3614-0000-c0c0-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	443	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:08 PM	ac2ce96e-3614-0000-c0c0-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	442	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	441	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	440	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	439	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:07 PM	ac2ce96e-3614-0001-ec08-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	438	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:07 PM	ac2ce96e-3614-0001-ec08-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	437	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	436	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:20:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	435	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	434	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	433	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM	ac2ce96e-3614-0002-1b01-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	432	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM	ac2ce96e-3614-0002-1b01-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	431	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	430	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	429	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM	ac2ce96e-3614-0002-0201-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	428	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM	ac2ce96e-3614-0002-0201-30ac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	427	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	426	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	425	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	424	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	423	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM	ac2ce96e-3614-0005-1b30-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	422	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM	ac2ce96e-3614-0005-1b30-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	421	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	420	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	419	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM	ac2ce96e-3614-0001-29f4-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	418	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM	ac2ce96e-3614-0001-29f4-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	417	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	416	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:46 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	415	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	414	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:45 PM	ac2ce96e-3614-0002-00fa-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	413	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:45 PM	ac2ce96e-3614-0002-00fa-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	412	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	411	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:45 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	410	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	409	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:43 PM	ac2ce96e-3614-0000-54ad-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	408	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:43 PM	ac2ce96e-3614-0000-54ad-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	407	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	406	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	405	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	404	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM	ac2ce96e-3614-0003-ec4c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	403	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM	ac2ce96e-3614-0003-ec4c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	402	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	401	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	400	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	399	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM	ac2ce96e-3614-0005-3c21-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	398	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM	ac2ce96e-3614-0005-3c21-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	397	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	396	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:42 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	395	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	394	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM	ac2ce96e-3614-0001-f5e1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	393	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM	ac2ce96e-3614-0001-f5e1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	392	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	391	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	390	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	389	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM	ac2ce96e-3614-0003-6140-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	388	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM	ac2ce96e-3614-0003-6140-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	387	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2460	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	386	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:36 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	385	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:35 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	384	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0002-23bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	383	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0002-23bd-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	382	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	381	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	380	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	379	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	378	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0005-e0f9-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	377	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3240	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0005-e0f9-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	376	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	375	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	374	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0002-97bb-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	373	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM	ac2ce96e-3614-0002-97bb-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	372	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4388	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	371	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	370	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	369	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM	ac2ce96e-3614-0001-b6bf-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	368	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM	ac2ce96e-3614-0001-b6bf-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	367	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	366	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	365	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	364	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:25 PM	ac2ce96e-3614-0003-601f-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	363	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:25 PM	ac2ce96e-3614-0003-601f-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	362	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:25 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	361	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:25 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	360	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	359	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	358	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	357	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM	ac2ce96e-3614-0000-d663-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	356	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM	ac2ce96e-3614-0000-d663-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	355	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	354	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	353	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM	ac2ce96e-3614-0001-d3b8-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	352	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM	ac2ce96e-3614-0001-d3b8-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	351	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	350	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	349	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-521c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	348	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-521c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	347	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	346	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	345	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	344	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0005-6ae1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	343	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0005-6ae1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	342	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	341	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	340	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	339	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	338	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-2a1c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	337	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-2a1c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	336	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2232	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	335	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	334	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-021c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	333	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:20 PM	ac2ce96e-3614-0003-021c-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	332	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	331	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:19 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	330	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	329	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM	ac2ce96e-3614-0002-bf22-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	328	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM	ac2ce96e-3614-0002-bf22-2fac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	327	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	326	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2920	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	325	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	324	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:06 PM	ac2ce96e-3614-0000-6853-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	323	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:06 PM	ac2ce96e-3614-0000-6853-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	322	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4372	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:06 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	321	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:19:06 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	320	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	319	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:58 PM	ac2ce96e-3614-0005-bbaf-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	318	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:58 PM	ac2ce96e-3614-0005-bbaf-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	317	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	316	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:58 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	315	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	314	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0005-75a7-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	313	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0005-75a7-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	312	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	311	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	310	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	309	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	308	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0000-903f-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	307	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0000-903f-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	306	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2648	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	305	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	304	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0002-97d9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	303	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM	ac2ce96e-3614-0002-97d9-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	302	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4976	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	301	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:56 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	300	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	299	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:50 PM	ac2ce96e-3614-0001-637f-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	298	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:50 PM	ac2ce96e-3614-0001-637f-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	297	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1136	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	296	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:50 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	295	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:49 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	294	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:48 PM	ac2ce96e-3614-0002-d5c7-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	293	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:48 PM	ac2ce96e-3614-0002-d5c7-2eac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	292	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	291	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:48 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	290	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	289	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:47 PM	ac2ce96e-3614-0005-9085-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	288	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:47 PM	ac2ce96e-3614-0005-9085-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	287	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	286	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:47 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	285	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	284	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:37 PM	ac2ce96e-3614-0003-3669-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	283	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:37 PM	ac2ce96e-3614-0003-3669-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	282	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	281	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:37 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	280	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	279	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:31 PM	ac2ce96e-3614-0001-4a07-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	278	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:31 PM	ac2ce96e-3614-0001-4a07-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	277	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	276	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:31 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	275	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	274	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	273	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM	ac2ce96e-3614-0000-9601-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	272	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM	ac2ce96e-3614-0000-9601-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	271	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4372	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	270	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	269	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM	ac2ce96e-3614-0002-80b1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	268	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM	ac2ce96e-3614-0002-80b1-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	267	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4572	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	266	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:29 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	265	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	264	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:26 PM	ac2ce96e-3614-0002-3ca0-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	263	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:26 PM	ac2ce96e-3614-0002-3ca0-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	262	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	261	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:26 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	260	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:22 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	259	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:22 PM	ac2ce96e-3614-0003-de05-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	258	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:22 PM	ac2ce96e-3614-0003-de05-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	257	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:22 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	256	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:22 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	255	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	254	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:21 PM	ac2ce96e-3614-0003-6b05-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	253	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:21 PM	ac2ce96e-3614-0003-6b05-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	252	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2136	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	251	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:21 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	250	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	249	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:20 PM	ac2ce96e-3614-0004-5f55-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	248	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:20 PM	ac2ce96e-3614-0004-5f55-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	247	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	246	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:20 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	245	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	244	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	243	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM	ac2ce96e-3614-0000-ecfb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	242	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM	ac2ce96e-3614-0000-ecfb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	241	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	240	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	239	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM	ac2ce96e-3614-0000-e5fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	238	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM	ac2ce96e-3614-0000-e5fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	237	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4752	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	236	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:10 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	235	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	234	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0001-00f9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	233	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1180	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0001-00f9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	232	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3056	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	231	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	230	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	229	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	228	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0001-f2f8-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	227	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0001-f2f8-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	226	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	1148	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	225	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	224	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0004-1d4b-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	223	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM	ac2ce96e-3614-0004-1d4b-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	222	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	2824	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	221	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:08 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	220	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	219	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:07 PM	ac2ce96e-3614-0000-aefb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	218	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:07 PM	ac2ce96e-3614-0000-aefb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	217	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3224	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	216	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:18:07 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	215	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	214	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:44 PM	ac2ce96e-3614-0002-0e42-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	213	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3340	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:44 PM	ac2ce96e-3614-0002-0e42-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	212	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4224	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	211	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:44 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	210	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	209	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:43 PM	ac2ce96e-3614-0000-91fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	208	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:43 PM	ac2ce96e-3614-0000-91fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	207	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3740	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	206	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:43 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	205	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	204	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:41 PM	ac2ce96e-3614-0003-20fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	203	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:41 PM	ac2ce96e-3614-0003-20fb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	202	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	4276	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	201	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	200	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	199	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM	ac2ce96e-3614-0002-d641-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	198	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3928	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM	ac2ce96e-3614-0002-d641-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	197	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	3376	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	196	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler has began loading for application <none>.	41	0		4	14	1	4611686018427387906	195	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4588	604	hv-cinder-78693	S-1-5-18	4/20/2021 7:17:40 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Protocol Handler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	194	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	4024	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:33 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	193	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1968	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:31 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	192	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:28 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	191	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:26 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	190	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:23 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	189	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1968	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:21 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	188	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:19 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	187	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:16 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	186	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:14 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	185	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:11 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	184	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4700	972	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:08 PM	ac2ce96e-3614-0002-d540-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	183	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4700	972	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:08 PM	ac2ce96e-3614-0002-d540-2dac1436d701	ac2ce96e-3614-0002-d740-2dac1436d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	182	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4700	2144	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:08 PM	ac2ce96e-3614-0002-d740-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	181	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4700	972	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:08 PM	ac2ce96e-3614-0002-d540-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	180	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4700	2144	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:08 PM	ac2ce96e-3614-0002-d540-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	179	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:16:03 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	178	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:30 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	177	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4920	2496	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:24 PM	ac2ce96e-3614-0004-e348-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	176	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4920	2496	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:24 PM	ac2ce96e-3614-0004-e348-2dac1436d701	ac2ce96e-3614-0004-e648-2dac1436d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	175	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4920	4732	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:24 PM	ac2ce96e-3614-0004-e648-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	174	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4920	3352	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:24 PM	ac2ce96e-3614-0004-e348-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	173	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4920	4732	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:24 PM	ac2ce96e-3614-0004-e348-2dac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	172	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	4024	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:15:19 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	171	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:02:28 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	170	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1968	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:02:24 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	169	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:51 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	168	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1968	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:48 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	167	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	4024	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:45 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	166	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:41 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	165	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:28 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	164	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:24 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	163	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:22 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	162	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:01:17 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	161	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:36 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	160	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:33 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	159	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:30 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	158	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:26 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	157	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:14 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	156	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:10 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	155	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:08 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	154	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 7:00:03 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	153	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:59:26 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	152	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:59:23 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	151	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:59:20 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	150	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:59:16 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	149	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:37 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	148	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:34 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	147	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:31 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	146	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:27 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	145	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:09 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	144	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:57:06 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	143	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:56:55 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	142	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:56:49 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	141	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:56:45 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	140	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:56:40 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	139	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:46:20 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	138	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:46:15 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	137	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:46:13 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	136	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:50 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	135	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:47 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	134	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:46 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	133	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:44 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	132	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:41 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	131	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:40 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	130	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:38 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	129	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:37 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	128	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:32 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	127	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:30 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	126	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:29 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	125	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:25 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	124	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:45:23 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	123	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:56 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	122	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:54 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	121	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	3712	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:53 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	120	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:49 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	119	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:37 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	118	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:33 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	117	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1672	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:30 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	116	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1796	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:29 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	115	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:04 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	114	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:02 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	113	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:44:00 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	112	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:59 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	111	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:57 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	110	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:55 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	109	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:53 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	108	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:47 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	107	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:28 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	106	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:24 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	105	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:22 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	104	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:20 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	103	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:12 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	102	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:43:01 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	101	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1368	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:56 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	100	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:40 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	99	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:37 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	98	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:34 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	97	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2964	3876	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:32 PM	ac2ce96e-3614-0004-d3eb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	96	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2964	3876	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:32 PM	ac2ce96e-3614-0004-d3eb-2cac1436d701	ac2ce96e-3614-0004-d4eb-2cac1436d701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	95	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2964	3632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:32 PM	ac2ce96e-3614-0004-d4eb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	94	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2964	3876	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:32 PM	ac2ce96e-3614-0004-d3eb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	93	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2964	3632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:32 PM	ac2ce96e-3614-0004-d3eb-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	92	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1664	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:22 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	91	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1668	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1001	4/20/2021 6:42:10 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	90	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	89	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	88	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3632	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	87	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	86	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	4036	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	85	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	84	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	1176	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	83	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	82	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	1176	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	81	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	80	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	4036	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	79	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	78	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	4036	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	77	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	76	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	4036	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	75	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	74	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	4036	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	73	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2548	3060	hv-cinder-78693	S-1-5-21-3043805253-1310308192-264236912-1000	4/20/2021 6:41:54 PM	ac2ce96e-3614-0004-f1ea-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	72	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2420	hv-cinder-78693	S-1-5-20	4/20/2021 6:41:06 PM	ac2ce96e-3614-0003-9de9-2cac1436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	71	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2420	hv-cinder-78693	S-1-5-20	4/20/2021 6:41:06 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	70	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1704	1812	hv-cinder-78693	S-1-5-20	4/20/2021 6:40:37 PM	73163061-3614-0000-8b30-16731436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	69	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1704	1812	WIN-5T344G8GM1H	S-1-5-20	4/20/2021 6:40:37 PM	73163061-3614-0000-8b30-16731436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	68	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1704	2084	WIN-5T344G8GM1H	S-1-5-20	4/20/2021 6:39:41 PM	73163061-3614-0000-8b30-16731436d701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	67	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1704	2084	WIN-5T344G8GM1H	S-1-5-20	4/20/2021 6:39:41 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	66	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	65	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke completed successfully	132	0		4	10	2	4611686018427387906	64	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3660	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/service	145	0		4	5	1	4611686018427387906	63	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3176	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	62	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	61	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	60	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	59	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	58	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	57	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	56	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	55	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	54	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	53	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	52	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	51	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	50	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	49	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	48	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	47	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	46	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	45	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	44	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	43	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	42	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	41	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	40	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	39	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	38	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	37	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	36	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	35	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	34	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	5108	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	33	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	32	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	2904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	31	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	30	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	29	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	28	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	27	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	26	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:25 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	25	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	24	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	23	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	22	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	21	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	20	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2624	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	19	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	18	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	17	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	16	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:56 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	15	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:55 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	14	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	13	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	12	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	11	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	10	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2888	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	9	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	8	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2480	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	7	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	6	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	5	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	4	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	3	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM service is unable to start because of a failure during initialization. The error code is 2	210	0		2	11	2	4611686018427387908	2	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	1	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]