CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 851 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 2116 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:21:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4336; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 850 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4336 | 1860 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 849 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:19:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {358241E9-FE7C-4574-8EDE-3D27A77C4082}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1574768752; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 848 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FC24675B-6D09-41E8-8058-C9B6FD6A1FF1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5f3dc29b-7649-4b3d-a030-e51ba44752ff"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 847 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {463212F6-61FE-4EE8-ADBB-83E1BFB01DAE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5f3dc29b-7649-4b3d-a030-e51ba44752ff",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 846 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F5452B74-9FDE-4C8B-B1D7-4340C1130367}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:71768DA8-DC7E-4BD7-A6D9-3BBD85FF4BA8"; ResultCode = 0x80048010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 845 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C07B0B7A-4079-4CC4-9E3A-FF37EE402AED}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{2BE3C7CE-E9D3-4084-A366-742B85488CA1}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 844 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CEE8D0BD-F9DC-4E9E-BF75-6B71A02B187D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1277352508; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 843 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {22608625-8C01-42DE-84B4-82EC6E0235E3}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d9e04edc-9aad-4ed0-a8df-e2823b7b68b0"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 842 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {67E5A467-D5C6-4206-B5FB-F91D4E6A2E36}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d9e04edc-9aad-4ed0-a8df-e2823b7b68b0",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 841 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:19:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5020; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 840 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5020 | 1060 | hv-cinder-80070 | S-1-5-19 | 12/15/2021 4:19:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 839 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:19:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 838 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:18:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FC9ECF15-0268-4718-B7B0-78A5B8B41532}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=795733214; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 837 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AEEE7553-C210-4214-A544-FD45EE0B8E65}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1441616467; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 836 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8356D968-16B2-4D94-A9B8-9C571514DEFE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=920948786; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 835 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8414043F-D1E7-4FF9-B2A3-A61690BEAA74}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B5FC24EB-53E6-4F19-BFFE-15F1BC643C53}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 834 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4586DAA8-D6B2-453B-B081-1EBD6D0992A5}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=531559748; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 833 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {89DD6730-305C-420D-A1BD-F0B104A2B6CE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C09E716E-032B-4E99-803E-6ED187EF6DED}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 832 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8D78BC14-CA39-4BA0-AB46-A5981401C7B8}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1286828410; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 831 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3ED88D98-2E9F-4375-A1BC-B2B849475723}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=478313147; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 830 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8F6DAC7D-CD99-4C79-A3F0-8630C9191876}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=708952005; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 829 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BF70A860-8D4D-4816-92D6-6DF23BFEA7ED}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=430751797; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 828 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F40F7210-0F19-4AC1-8A43-468FD9758A99}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=210627139; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 827 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:17:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {24B2393A-684D-4193-95FC-5ACC74630E79}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-03b70d28-5530-488d-ad60-d89b989c83df"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 826 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A441DC8F-C0D3-42A7-BD78-DBEB9EBA00E1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-03b70d28-5530-488d-ad60-d89b989c83df",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 825 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AB42F420-981C-499D-8693-B11D10E7E1ED}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{1A1B185F-A3B8-47C9-84D1-E964F811D501}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 824 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1948C346-A59A-45FF-9610-2323045ACA25}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B91EED03-125B-4266-9061-0777A413FC50}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 823 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B133F6C8-2F1D-487A-AA86-98012DAAF825}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CFD01419-E362-4C64-BF2F-220EBA1C1510}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 822 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DAE32E33-4816-45EA-92C4-DFBECA3352BC}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=829266697; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 821 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9D5314A8-6734-48FF-9850-C079709642B3}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0C317D46-3B36-4878-BC99-ADC2418A0584}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 820 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BF6ABF41-D17E-46CA-819E-6EA918B36A38}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e5b10ba2-0ddd-47f4-9c02-37603d2b2e88"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 819 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FC8C2DB2-D374-489B-8B17-C75A9D018496}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e5b10ba2-0ddd-47f4-9c02-37603d2b2e88",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 818 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3B9C2E8C-0AAD-4C78-9260-CA21BD65D589}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E2BEB558-1365-438C-B546-AE8EDAED67AE}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 817 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3358C513-62DE-4BB5-9595-96D5EF31DCB1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{55DA8880-804E-48DE-B821-EB67F1251BBE}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 816 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C8D0893-AEF8-4BFF-9727-DCE3CD0E19D7}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0590B0F7-E8C3-4EDA-AA8F-802BC87B0F49}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 815 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DB592536-4B8E-4975-B023-05299261040B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=300584526; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 814 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {32BC06F4-3902-4B83-AB83-82B944A1442D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=378590721; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 813 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8435AA1B-A831-4B13-AAF2-5CA7195D4DEE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7A125B79-F344-4939-AE43-F6589DBDD6A0}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 812 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A0254B86-50B4-43F1-893F-B614011E0F7E}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=28555011; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 811 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:16:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2BEAD55F-A5CF-4475-845A-B8F3476B3E49}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=139479765; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 810 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F0D4C165-B880-4502-A596-13E5ED11836E}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E49BFF37-3E73-440C-AB95-66236113B9F5}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 809 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {47B5B06A-05F6-4856-8359-27F75205FE6C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A652D3D9-E050-4EF2-B296-23C68EA8EEA8}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 808 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B0511C8B-40D2-4F82-8933-C1AB1A8F3281}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1881504397; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 807 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:41 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {53C23C5B-1BBC-4616-AED6-5698C10D38F2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B5EA25EA-91C1-43A8-8344-B2AABDE9B281}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 806 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BE43FFA2-40EE-4404-B003-19FCF98971B9}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=714653387; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 805 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A36546BC-7EBE-42BB-B039-9EAAA8A5A503}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=38121594; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 804 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {859856DB-1CCD-454F-94FC-3C2CFB1A1E2F}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{2DCA9E63-77B0-484E-A9ED-EE538D707BC6}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 803 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D5A91A51-F656-4D3B-B357-B4B544C2BF82}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=646626563; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 802 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9C012653-E6CB-41FE-9B32-BAEBD45A6999}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1728192268; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 801 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3F0AFC36-9986-4E3E-AD3C-678A83359456}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=478306301; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 800 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BF0DEFCD-C81D-476C-9192-28C0C09510AD}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-5f3dc29b-7649-4b3d-a030-e51ba44752ff"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 799 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C58DAE90-D9CA-4834-AD94-A03BB9A49E03}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{DD0A71A9-7014-447A-9CDE-D2A8C8F95552}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 798 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {92F70179-3EB5-4EF4-8F34-7D644374C180}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-5f3dc29b-7649-4b3d-a030-e51ba44752ff",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 797 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {69B1F2DE-3FFF-458C-B405-8BC046496F68}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E9DEC809-C088-4D78-9A8A-F51F4A036D66}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 796 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 795 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:15:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0F6F929E-C753-4B6B-A144-6E692E8FAE83}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:39058CA4-D63B-4EB6-B66A-73913ECD911F"; ResultCode = 0x80048010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 794 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1EBCCBD4-6861-4EFA-8DDD-075FA37D4DB1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1660316345; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 793 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {619560B1-BC8E-4237-BBCD-43B6649616F4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=639247722; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 792 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3EB6BEC8-CBBD-41DD-81A4-89E244EF0DD2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=610161898; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 791 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:15:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D1B26207-B1DF-4E0B-89A7-3E4F951B3FB2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1064993862; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 790 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {78B2C64C-D695-40AD-89FA-AFB82578524C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=916531410; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 789 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CA44E9A9-BBAC-4385-A552-8CCF18B2B48A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=580804300; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 788 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2CB311F9-1459-4F79-8180-ED12AD63D747}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{405EAA5A-4DC3-4ACF-9220-72847A4F7F17}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 787 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {5D25BFF1-75D9-4AC9-ADBA-FC3C5A3F200D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1263508616; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 786 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F6D13223-D594-4F46-A9E0-5613C75F7293}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2003893907; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 785 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A5CE0153-1B1E-4756-BB32-027AB774CD19}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=791394043; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 784 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9F9310B4-1299-4A99-B78B-2333ECD1AC70}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{AAF87678-410C-4179-80D4-05687B02D471}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 783 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {398DE06E-0144-44F6-9F16-12DBE51BA973}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1492025432; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 782 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {744957B0-75B4-4D7C-940E-60D4BEF16DCE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=172068709; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 781 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3C1A8C10-F1F0-4A92-9A8E-4151E7A24196}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=684623657; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 780 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4BAD75ED-2565-4439-A609-C39D064DE02C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1826371715; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 779 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7227906B-5934-404F-8B10-B118D9658B6A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d721d243-be0a-4253-bc0e-c296862c0341"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 778 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {58E6F251-D2C8-4419-AB4F-FCC31121CBE4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d721d243-be0a-4253-bc0e-c296862c0341",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 777 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D5CDFD2E-84E5-4BCA-BFAB-C6E1B2630611}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:52792587-B0A9-4F13-A797-04F24ABC8DFB"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 776 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {07EA0BF5-9300-4EDB-AF13-85E1FF1C1F57}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=751354648; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 775 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9B76F457-6E71-4A87-A678-AE3BA9EB62C0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1313154351; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 774 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D3020DBC-98A7-4071-842D-F6EB5355F1C5}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1051261048; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 773 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {30CCA4C0-29A3-4670-B42D-E79A906B54F6}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-88490dc8-947f-4ffb-bb93-47a9affa59c5"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 772 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7F773535-71EC-456D-911D-BF54F330D5EC}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-88490dc8-947f-4ffb-bb93-47a9affa59c5",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 771 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D8F7C47F-F52E-4934-B2AB-CB9AED524F41}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-91883ea6-77b3-424f-98e7-9034a2841ab7"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 770 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CAE56E69-2143-4944-95FC-65AE6B1CD54C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-91883ea6-77b3-424f-98e7-9034a2841ab7",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 769 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:14:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 768 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:13:50 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {484C0C1F-F14D-40A0-8FB7-7F939BEDD84B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=837392086; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 767 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BE07970E-5E9A-453F-9CE0-08620434C926}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=783984310; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 766 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3FAC1EA2-440E-4D4D-9232-DDD801FABBB6}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1783258764; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 765 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1B93A83D-2C9B-4FF7-A12F-AFFECD4F5876}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=266505039; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 764 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4000A7EB-AA79-4E1B-A2A7-3E39801DC52B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8C8A5B85-F2E9-4705-B7C0-04474D4C135C}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 763 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6320E90F-558C-435A-94A2-70E5C01A0F1C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=868245368; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 762 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2772 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {71655622-CFFA-438D-8E2C-D88E3F515CD1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{50C75410-F974-42A1-9157-B817002CFE43}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 761 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {34638689-B2C1-44E7-B4C2-73125BB94194}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2118856943; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 760 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:13:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6CDA87A2-8858-48BD-9E24-1C2A9C68BD8A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=998059157; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 759 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {662DEBC2-813D-4D92-8189-CB73CAC7E35C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1818118285; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 758 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B16329A3-B5E6-46B9-A4B8-1CB7E84915E4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d721d243-be0a-4253-bc0e-c296862c0341"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 757 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A532C062-7C52-459C-BD8F-17EEB8F5F7CE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d721d243-be0a-4253-bc0e-c296862c0341",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 756 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4992 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0C29834A-C319-45A2-85E9-27094766DAC4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1883431939; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 755 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A2BAB137-15EF-446A-9F81-8D39C4E8B44B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:E09104F2-6DA2-4F86-8C98-9CE7617E446B"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 754 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 836 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B19D5218-7EE0-4A1B-A974-895F5E7E6947}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1678509024; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 753 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9AF87DD7-8427-439A-B4C8-29B2303D44D1}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=163510840; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 752 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B576A6E4-1225-4833-BA33-325C4083079D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d7453ce8-d917-418c-a271-208103f6e5d1"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 751 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {80E76F83-3CDF-42CA-8E43-F34C76F7E636}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d7453ce8-d917-418c-a271-208103f6e5d1",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 750 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C2D25D1D-2705-4B15-A4BB-7B6D5109CCED}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1491142099; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 749 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7F98A669-EAA4-4827-A8CA-9AA98DC757B0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1267332660; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 748 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 836 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E4FAA0EE-38B8-420A-80AE-71CDF4A18F81}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=568676147; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 747 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:12:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {483DBCB3-B54C-40FD-B034-62A15FF4D990}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1053242102; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 746 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {99F53016-245A-435C-9E60-1B2A400DF4E0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=84415621; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 745 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2B9878F1-8EAD-4DA3-8A53-496C4E66AA15}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-12d32ac1-9064-43be-8709-9da3910a3ce6"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 744 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1A14BD35-4B24-4590-B1BF-564CE3F01834}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-12d32ac1-9064-43be-8709-9da3910a3ce6",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 743 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:52 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {EC2E37B4-9384-4360-8F95-CBB4507C3D69}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=454688680; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 742 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {04FBA70E-CE29-46AD-A93E-8F059DA1E9CE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=875690172; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 741 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {382D9F8B-0098-40B0-B281-A408A5F1765E}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1558352775; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 740 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 836 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E514357D-9A75-441F-9B3F-C1598624AC51}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1540769959; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 739 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 836 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:44 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E1C66475-7A50-4404-AE2B-43E3F4FBA764}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=527611038; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 738 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CA7D08B6-096C-44B4-8189-9C44F46E823B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=781408302; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 737 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {467D21D0-0511-4130-8D60-535C21309629}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1877076257; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 736 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {38DAEEDE-6D66-4E79-896E-8387E1EA5F65}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{39AE0EF3-3EEE-4757-BF4E-E25237D57C89}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 735 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {649BD671-51AE-4D73-9DDF-58C84D960454}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=832140999; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 734 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C817F5E5-065B-4E29-BC60-9CFFFC618C42}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=831559039; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 733 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {520A289E-A26F-47B3-BA86-B0FCE304BFF2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BE015A6A-DAEA-416B-AA4F-296246178975}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 732 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BA1D8045-8392-4A8E-B4C2-759A20BD32AC}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-e8b7ddce-face-4d4e-89a3-987cdadf0f5c"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 731 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4992 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {57466A3F-4989-4EED-90AF-F7807F46F338}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-e8b7ddce-face-4d4e-89a3-987cdadf0f5c",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 730 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4992 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A463371A-660E-4EFE-A2CF-E33757A6F027}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=800747252; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 729 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F2227E57-A3A2-49BF-A961-5A03E8DC9258}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1197613575; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 728 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F9D8F7A2-A464-4057-BAAE-2A087ADCC461}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=424105183; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 727 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 726 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:11:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {53C01D59-C3EA-4EDD-9E46-FB7269115A85}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:18100E2E-7CE5-468A-99BD-0FBEF0BA7D37"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 725 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4992 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {42A7F7E3-5158-4556-AC03-F205CD905997}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=409265969; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 724 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6EC958D5-1DEA-4F70-A9B4-D08F77E27959}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=428836261; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 723 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B2788B49-1983-4575-ACA5-BD494426F933}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1597441530; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 722 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {188B96A8-944B-4360-B3F1-C6784EB8860E}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b8eec395-7b09-4b46-9a04-390c4b2da715"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 721 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F71F924C-74D0-4C2A-A15B-EFA262EDA847}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b8eec395-7b09-4b46-9a04-390c4b2da715",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 720 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {561C2D0E-A769-487D-91D2-53ACDD6B7B37}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:3A669E6C-9EB9-46F6-998A-32E1DAFE5F25"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 719 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5008 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:11:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BAD30F03-ACB4-4310-9439-65E448B87B7D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1391190324; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 718 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4D8B6A2C-8FC4-4E6D-AB1D-16B2095CE052}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:EF3245F9-AA4E-471C-9AAE-47C11B85169E"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 717 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DA729779-4F16-4D7F-AEA1-1B374F4364FB}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1795279131; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 716 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9F950ADC-39CE-4F4D-966C-99FFD4CED41C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1786445189; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 715 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2184 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F57DA825-FBEA-4FFE-A058-43C4BC6A5030}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B46339F4-2DC7-4D4B-B9B5-0213792356E4}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 714 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {E8DB7135-32E0-498D-ADFA-4AB19AC05AF4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ba9708aa-8c64-4af8-8e26-8cfaeed9e3ec"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 713 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F9BBDC3F-0721-401B-886B-5AA0B9CFC714}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ba9708aa-8c64-4af8-8e26-8cfaeed9e3ec",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 712 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1D3CB0EE-94CC-491A-AAB2-69A4492D156B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{A62FACA5-7DF0-4E60-BD91-32BD9E8C19FB}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 711 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {103697FD-8218-4D41-9617-6A5E799F6F1A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F105DAD8-2B77-41F9-AA54-47622F12F20E}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 710 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {826A26CF-85E0-46E7-9435-60F2611C41C3}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1463044757; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 709 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:19 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {95CA1D4D-E7D8-4672-A9FD-113E88D0137A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=379125898; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 708 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C6951BF-D021-48F9-B01C-8B513F0029D7}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=373799638; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 707 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DE8FD8C4-D554-4C59-868A-7D0F46AFC318}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{99D86C8E-B65E-48EF-BBDF-E95064978448}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 706 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {31DA847A-60F0-49A7-BC87-59C7A77C51EA}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{70FBD321-9231-47FA-89B2-48440BBE6886}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 705 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:10:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D5F100D0-364A-4DA5-A1EB-DD46C3D7B845}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=703146617; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 704 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2F89311D-7949-45AF-AA11-AE5F41011781}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=401581771; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 703 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A464E999-1027-4DC8-8B3A-A2BEF58FD1E0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1067794365; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 702 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:55 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {82AA3535-FF80-4390-B173-D25E60014C26}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fe45f33d-03d7-4911-b076-96bfef3b09ba"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 701 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {8CF564FF-B1BF-4472-B866-7D2508E974C4}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fe45f33d-03d7-4911-b076-96bfef3b09ba",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 700 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5076 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A0003883-7491-48DC-8DC9-2256912AD8C9}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1289570805; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 699 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {1324C042-BC45-4C42-85C1-FD75CE0DF68A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=352175401; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 698 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6ED5FE28-8145-419D-B5D9-A2C7F2838CC0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1933635462; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 697 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {064AAC33-BA57-4ED1-9FFB-43923577C33F}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F6333B8F-577B-48B9-B13A-C70B8E6FD799}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 696 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:21 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4B5CB709-53DC-43C2-B998-D2937F565AC0}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{300283B8-A739-4FE6-B0DA-34693A9321B1}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 695 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {527BD4D7-6550-4CB6-A652-62ABF82CA0CA}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1542343887; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 694 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {3C290024-7434-49F1-B2E6-C151F1A3707E}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=825941808; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 693 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DAC1CB58-B2D3-4D2D-AF98-6255CC7CC8F8}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=393896654; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 692 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {DE0509A8-DA4E-442A-8862-A944B2A6720B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1129370222; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 691 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3872 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:09:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {04C399F8-31E3-44F0-897B-0BCA4FC28AEC}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1780; Component = Unknown; Operation = Start IWbemServices::GetObject - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSettingData.InstanceID="Microsoft:527A6F90-6CD2-46AC-AC53-A2AE13C326BE"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 690 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {ADA5D536-353B-4754-BE15-9887AAE154B7}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-88b529a4-e356-4e5b-9080-5a385be851a2"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 689 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 836 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {09FD6EBE-9784-4F51-B4AD-85509C1DFE1C}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-88b529a4-e356-4e5b-9080-5a385be851a2",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 688 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 100 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {AF18B0F1-0372-46E5-B627-4A2CECFEDB5D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=556104223; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 687 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3200 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {2A6EBE3F-EEDB-42AE-A1D4-7F6C73945BF2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ce035b64-56d3-408d-ae8a-661cd84c0f1e"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 686 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6D6D8C59-467A-4294-A35E-2AFC5E957EF9}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ce035b64-56d3-408d-ae8a-661cd84c0f1e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-80070"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 685 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C3805D1F-BAFC-4149-A675-2AE56B1CC621}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=776020762; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 684 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:22 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BC6DE0A1-24B4-4026-A5D7-7A367BAF1ACE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1303020977; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 683 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5076 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:18 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {156E2449-3038-4CED-B3E2-538CDB020E9B}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1912223414; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 682 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {B7E0AF76-54BD-4AA0-93B0-BE7F0A2D9A02}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1253927449; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 681 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1484 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {92DDD91E-DF4B-4475-BA68-8F0D45511F16}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2102144794; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 680 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4064 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 679 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 2116 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:08:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {C4773F3A-A0E0-4077-A1C3-E02DC8564DCB}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{47D42AC8-7209-4066-A0DF-AEE25F0370B4}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 678 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5076 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {D800CD22-BF14-4825-A658-1100955280FE}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C503A177-3B7D-4367-8045-D95F8DB46D51}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 677 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {091A02EC-0861-4C96-9D76-C3270E0E0C77}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=367960904; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 676 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:02 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {6FBA6B92-72C8-4466-A39A-F7F3B5C1C5E2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C8257FE0-82C1-49C9-86F5-90F0A67B85B1}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 675 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 4332 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:08:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {41BF09A8-D3A8-494B-A048-C82F4454ED79}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2036041890; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 674 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {0F948AF0-A4ED-4B16-BDB7-399E46FF0CC2}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B7C44C09-C227-4EAB-A482-3B097427DDD2}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 673 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {F8808A18-9AE2-4A54-BC6F-670D48231FAF}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2139019351; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 672 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4CEE4B4F-6CFF-42DF-B689-1B56E2D25BD5}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{07BB225C-6C67-4EFE-BD05-833ADE439109}"; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 671 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1244 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:49 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {84E9FB66-8C41-4C7E-902E-DEA69AF14D5D}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=684574419; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 670 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3048 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {239641CF-CCF1-432A-BE71-793716D7285A}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4232; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=195179909; ResultCode = 0x80041024; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 669 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3612 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:07:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 668 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 667 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 666 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 916 | hv-cinder-80070 | S-1-5-19 | 12/15/2021 4:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 665 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:07:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3592; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 664 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3592 | 1672 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 663 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 1092 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:05:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5084, ClientMachine = HV-CINDER-80070; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 662 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5008 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 5084, ClientMachine = HV-CINDER-80070; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 661 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5008 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:28 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 1780, ClientMachine = HV-CINDER-80070; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 660 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 5008 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1616; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 659 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1616 | 4604 | hv-cinder-80070 | S-1-5-19 | 12/15/2021 4:05:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4268; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 658 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4268 | 2312 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 657 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:05:10 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3592; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 656 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3592 | 1672 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 4:05:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 655 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:05:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3908; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 654 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3908 | 4164 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 4:05:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4268; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 653 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4268 | 2312 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:55:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4184; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 652 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4184 | 3104 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:54:35 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4184; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 651 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4184 | 108 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:54:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4184; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 650 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4184 | 3104 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:54:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3856; ProviderPath = %systemroot%\system32\wbem\msiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 649 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3856 | 3904 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:37:45 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 648 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4880 | 4876 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:35:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CDA3FBF3-F1C8-0002-E5FE-A3CDC8F1D701}; ClientMachine = HV-CINDER-80070; User = HV-CINDER-80070\Admin; ClientProcessId = 1180; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 647 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 496 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CDA3FBF3-F1C8-0002-E5FE-A3CDC8F1D701}; ClientMachine = HV-CINDER-80070; User = HV-CINDER-80070\Admin; ClientProcessId = 1180; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 646 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1372 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {CDA3FBF3-F1C8-0002-E5FE-A3CDC8F1D701}; ClientMachine = HV-CINDER-80070; User = HV-CINDER-80070\Admin; ClientProcessId = 1180; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 645 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1372 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-80070\Admin; ClientProcessID = 1180, ClientMachine = HV-CINDER-80070; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 644 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1372 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-80070\Admin; ClientProcessID = 1180, ClientMachine = HV-CINDER-80070; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 643 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1372 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:58 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1756; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 642 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1756 | 2848 | hv-cinder-80070 | S-1-5-19 | 12/15/2021 3:33:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 641 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:56 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3988; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 640 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3988 | 3968 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3604; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 639 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3604 | 2220 | hv-cinder-80070 | S-1-5-19 | 12/15/2021 3:33:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3856; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 638 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3856 | 3904 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3988; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 637 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3988 | 364 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 636 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 3296 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:43 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %systemroot%\system32\wbem\wfascim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 635 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2836 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1380; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 634 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1380 | 2224 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:33:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 633 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:33:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3328; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 632 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 672 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3328; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 631 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 672 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3856; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 630 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3856 | 3904 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = HV-CINDER-80070\cloudbase-init; ClientProcessId = 3600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 629 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 496 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %SystemRoot%\System32\sppwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 628 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:32:26 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 627 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 626 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 625 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 624 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2836 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 623 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 622 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 621 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 620 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 619 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 618 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 617 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 616 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2836 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:32:08 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 615 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 614 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3020 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3264; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 613 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 1108 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1380; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 612 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1380 | 3408 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:32:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 611 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:32:00 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 610 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 609 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 608 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 607 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 606 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 605 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 604 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 603 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 602 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 601 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 600 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 599 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 598 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 597 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 596 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 595 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 594 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 593 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 592 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 591 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 590 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 589 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 588 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 587 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 586 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 585 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 584 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 583 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 582 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 581 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 580 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 579 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 578 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 577 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 576 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 575 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 574 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 573 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 572 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 571 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 570 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 569 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 568 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 567 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 566 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {BEA971ED-EAF2-4A72-8054-61CDE10D3E91}; ClientMachine = HV-CINDER-80070; User = ; ClientProcessId = 584; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 565 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:57 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 584; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 564 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 3104 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:47 PM | cda3fbf3-f1c8-0005-37fd-a3cdc8f1d701 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 563 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 562 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2220 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 561 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:31:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3856; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 560 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3856 | 3904 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3856; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 559 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3856 | 3904 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:46 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2968; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_3929267931_1446543849_3757471236_500"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 558 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:42 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-80070; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2492; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 557 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 584 | 2412 | hv-cinder-80070 | S-1-5-18 | 12/15/2021 3:31:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2552; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 556 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2552 | 2604 | hv-cinder-80070 | S-1-5-20 | 12/15/2021 3:31:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-1V6J56RSNMM; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 555 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 520 | 752 | WIN-5T344G8GM1H | S-1-5-18 | 12/15/2021 3:31:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-1V6J56RSNMM; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 554 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 520 | 752 | WIN-5T344G8GM1H | S-1-5-18 | 12/15/2021 3:31:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-1V6J56RSNMM; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2184; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 553 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 520 | 2540 | WIN-5T344G8GM1H | S-1-5-18 | 12/15/2021 3:30:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-1V6J56RSNMM; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1764; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 552 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 520 | 2536 | WIN-5T344G8GM1H | S-1-5-18 | 12/15/2021 3:30:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 551 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 550 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:09 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 549 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 548 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4460 | 5048 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:46:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 547 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4848 | 4776 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:45:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 546 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 1176 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll" | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 545 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 544 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 543 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:42:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 542 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 541 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 540 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:48 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 539 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 538 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 3064 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:42:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 537 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4120 | 4148 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:43 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 536 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 1292 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 535 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3752 | 2228 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 534 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 533 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2172 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | ad8d0f9c-9109-0001-0a10-8dad0991d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 532 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 531 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 388 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 530 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 529 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 528 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 527 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 526 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 525 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 524 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 523 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 522 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 521 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 520 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 519 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 518 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 517 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 516 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 515 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 514 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 513 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 512 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 511 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 510 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 509 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 508 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 507 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 506 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 505 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 504 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 503 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 502 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 501 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 500 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 499 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 498 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 497 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 496 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 495 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 494 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 493 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 492 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 491 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 490 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 489 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 488 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 487 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 486 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 485 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2680 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 484 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2776 | 2848 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:41:31 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 483 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2692 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 482 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 1548 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:40:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 481 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 480 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 479 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 478 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 477 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 476 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 475 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 474 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 4728 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 473 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 472 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 471 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2712 | 592 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:38:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 470 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 2924 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 469 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4444 | 4516 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 468 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 467 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 466 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4348 | 4632 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:35:41 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 465 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 464 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1548 | 2160 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 463 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 1600 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 462 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:34:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 461 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 764 | 1020 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:33:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 460 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 459 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4824 | 4808 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:32:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 458 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:31:16 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 457 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 456 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1520 | 2704 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:29:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 455 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2716 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 454 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:32 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 453 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4608 | 4636 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:30 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 452 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2896 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 451 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4344 | 4368 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:26 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 450 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:25 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 449 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:20 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 448 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:19 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 447 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | aff0bd57-9107-0002-9bbd-f0af0791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 446 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 445 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 444 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 443 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 442 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 441 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 440 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 439 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 438 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 437 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 436 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 435 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 434 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 433 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 432 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 431 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 430 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 429 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 428 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 427 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 426 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 425 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 424 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 423 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 422 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 421 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 420 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 419 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 418 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 417 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 416 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 415 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 414 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 413 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 412 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 411 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 410 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 409 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 408 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 407 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 406 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 405 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2868 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 404 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 403 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 402 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 401 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 400 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 399 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 398 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 397 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 396 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 395 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 394 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 393 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 392 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 391 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 390 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 389 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 388 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 387 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 386 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 385 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 384 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 383 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 382 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 381 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 380 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 379 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 378 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 377 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 376 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 375 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 374 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 373 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 372 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 371 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 370 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 369 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 368 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 367 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 366 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 365 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 364 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 363 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 362 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 361 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 360 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 359 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 358 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 357 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 356 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 355 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 354 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 353 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 352 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2872 | 2900 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 351 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2864 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 350 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 349 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 348 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 347 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 346 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 345 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 344 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 343 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 342 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 341 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 340 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 339 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 338 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 337 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 336 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 335 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 334 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 333 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 332 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 331 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 330 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 329 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 328 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 327 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | 96ed06e7-9107-0000-3d07-ed960791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 326 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:51 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 325 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 324 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 323 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 322 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 321 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 320 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 319 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 318 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 317 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 316 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 315 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 314 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 313 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 312 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 311 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 310 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 309 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 308 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 307 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 306 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 305 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 304 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 303 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 302 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 301 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 300 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 299 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 298 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 297 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 296 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 968 | 2820 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 295 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 294 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2880 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:44 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 293 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2840 | 2864 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:26:42 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 292 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2620 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 291 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:25:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 290 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2528 | 3456 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:24:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 289 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 288 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 3804 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 287 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 4092 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 286 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2508 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:24:53 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 285 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3200 | 3644 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 284 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2920 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 283 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2540 | 3240 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:12 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 282 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 281 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 280 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 279 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2916 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | 17f2f0cc-9107-0002-12f1-f2170791d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 278 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 956 | 2908 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 277 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2884 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:23:02 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 276 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3808 | 4032 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:14:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 275 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 274 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2972 | 156 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:14:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 273 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 2720 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 272 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2664 | 1584 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:14:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 271 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4136 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:11:39 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 270 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4368 | 4496 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:10:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 269 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1784 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:05:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 268 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 267 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 1396 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:04:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 266 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 452 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 265 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 952 | 1000 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 9:04:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 264 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3176 | 3364 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:58:49 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 263 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 262 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:57:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 261 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 260 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4672 | 4700 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:56:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 259 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | 289cfce6-9103-0003-f9fd-9c280391d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 258 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1180 | 4340 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:56:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 257 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:06 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 256 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:55:05 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 255 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:55:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 254 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4020 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 253 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 4052 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 252 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 4008 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 251 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3968 | 3996 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 250 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3880 | 3916 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:54:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 249 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 3004 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:34 AM | 7c5c4ffb-9102-0000-4a51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 248 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1200 | 2840 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 247 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | 7c5c4ffb-9102-0001-8851-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 246 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2792 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:52:27 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 245 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | 7c5c4ffb-9102-0001-5f51-5c7c0291d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 244 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1192 | 2796 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 243 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3932 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:38 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 242 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:37 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 241 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 428 | 1316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:51:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 240 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 239 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3888 | 3916 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 238 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3872 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 237 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3832 | 3860 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:51:04 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 236 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4796 | 840 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:45:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 235 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2284 | 2676 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:44:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 234 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 233 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2300 | 4360 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 232 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 2728 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 231 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2548 | 3736 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:44:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 230 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1052 | 4868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:36:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 229 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3184 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 228 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 4616 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 227 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:14 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 226 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 225 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:13 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 224 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 223 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:11 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 222 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 221 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2920 | 4532 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 220 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1368 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 219 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:34:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 218 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4228 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:15 AM | 9a81cb05-910f-0003-8acc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 217 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 216 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 215 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 214 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 213 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 212 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 211 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 210 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:33:01 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 209 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 5076 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 208 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:59 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 207 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 2868 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 206 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1912 | 3084 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 205 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1164 | 1532 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:32:58 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 204 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 203 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 996 | 456 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:29:00 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 202 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4324 | 3568 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:27:56 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 201 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | 9a81cb05-910f-0000-a4cc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 200 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 3260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:26:55 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 199 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:26:50 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 198 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:25:57 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 197 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | 9a81cb05-910f-0003-4bcc-819a0f91d301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 196 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 964 | 4648 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:25:52 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 195 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3768 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:46 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 194 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4124 | 4152 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:15 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 193 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3820 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 192 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3084 | 3436 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 191 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:08 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 190 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 189 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/19/2018 8:24:03 AM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 188 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 3176 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:37:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 187 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 186 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2788 | 2624 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 185 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2192 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 184 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2504 | 2440 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:37:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 183 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4024 | 3868 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:27:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 182 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 181 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1500 | 2664 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 180 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 3280 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 179 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1288 | 4056 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:27:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 178 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 652 | 1972 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:17:16 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 177 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 3152 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 176 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 3124 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 175 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1184 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 174 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4032 | 1160 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:17:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 173 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1088 | 4088 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:10:25 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 172 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:08:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 171 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | b65c0852-8ef4-0003-8709-5cb6f48ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 170 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 3928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:08:20 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 169 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:37 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 168 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 1752 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 167 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4072 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 166 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4076 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 165 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 4060 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 164 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:07:14 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 163 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 162 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 161 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 160 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:34 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 159 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 158 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 157 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 156 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 155 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 154 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 153 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:33 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 152 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 151 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:32 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 150 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2832 | 2860 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 149 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2784 | 2812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:06:27 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 148 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4892 | 836 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 6:02:36 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 147 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4256 | 4144 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:53:30 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 146 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 145 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5092 | 2628 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:53:24 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 144 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 3800 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 143 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4976 | 5116 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:53:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 142 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4780 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:50:11 PM | 53b2b737-8ef1-0000-6db9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 141 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3688 | 2160 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:46:15 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 140 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | 53b2b737-8ef1-0003-feb9-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 139 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 4676 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 138 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:44:12 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 137 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4212 | 4236 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:31 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 136 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 2796 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:29 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 135 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 3216 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 134 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3208 | 3308 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 133 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:23 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 132 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 131 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 976 | 324 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:43:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 130 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | 53b2b737-8ef1-0001-8eb7-b253f18ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 129 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1152 | 2720 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:38 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 128 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3696 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:37:24 PM | a4626349-8ea8-0003-b36d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 127 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 164 | 3628 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:35:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 126 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3868 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:35:07 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 125 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 428 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:04 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 124 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 4924 | 5928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:03 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 123 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | a4626349-8ea8-0002-ed6e-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 122 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2052 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:34:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 121 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5028 | 5328 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:32:53 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 120 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 119 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3816 | 1224 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 118 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 5824 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 117 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5804 | 912 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:32:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 116 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3180 | 804 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:22:47 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 115 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 114 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 888 | 5288 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 113 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 5300 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 112 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3772 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:22:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 111 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5964 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:54 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 110 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1992 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:12:41 PM | a4626349-8ea8-0000-8a6d-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 109 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 108 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2736 | 2320 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 107 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1960 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 106 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 1260 | 1936 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:12:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary | 5860 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 105 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | a4626349-8ea8-0003-146c-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 104 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3016 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:06:17 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 103 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 102 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3428 | 5844 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:06:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 101 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1104 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:05:59 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 100 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:04:01 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent | 5859 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 99 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 3356 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | a4626349-8ea8-0003-c36b-62a4a88ed301 | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter:
instance of __EventFilter
{
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventNamespace = "root\\cimv2";
Name = "SCM Event Log Filter";
Query = "select * from MSFT_SCMEventLogEvent";
QueryLanguage = "WQL";
};
Perm. Consumer:
instance of NTEventLogEventConsumer
{
Category = 0;
CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0};
EventType = 1;
Name = "SCM Event Log Consumer";
NameOfUserSIDProperty = "sid";
SourceName = "Service Control Manager";
};
| 5861 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 98 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 1768 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:03:48 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 97 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3704 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:51 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 96 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 812 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 95 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 5960 | 5988 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 94 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:39 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 93 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2352 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:13 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 92 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 91 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 90 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 89 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 88 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 87 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 86 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 85 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 84 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 83 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 82 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 81 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 80 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 79 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 78 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 77 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 76 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 75 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 74 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 73 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 72 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 71 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 70 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 69 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 68 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 67 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 66 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 65 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 64 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 63 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 62 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 61 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 60 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 59 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 58 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 57 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 56 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 55 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2768 | 1124 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 54 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 53 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 52 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 51 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 50 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 49 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 48 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 47 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 46 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 45 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 44 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 43 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 42 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 41 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 40 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 39 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 38 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 37 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 36 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 35 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 34 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 33 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 32 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 31 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 30 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 29 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 28 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 27 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 26 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 25 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 24 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 23 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 22 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 21 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 20 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 19 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 18 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 17 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 16 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 15 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 14 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 13 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 12 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 11 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 10 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 9 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 8 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2528 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 7 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 3440 | 3468 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 6 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 5 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 924 | 2484 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 4 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 3084 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:06 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll | 5857 | 0 | | 0 | 0 | 0 | 4611686018427387904 | 3 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 2856 | 2436 | WIN-5T344G8GM1H | S-1-5-20 | 1/16/2018 5:02:05 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 2 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown | 5858 | 0 | | 2 | 0 | 0 | 4611686018427387904 | 1 | Microsoft-Windows-WMI-Activity | 1418ef04-b0b4-4623-bf7e-d74ab47bbdaa | Microsoft-Windows-WMI-Activity/Operational | 916 | 2392 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:40 PM | | | microsoft-windows-wmi-activity/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Error | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |