Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
Summary of disk space usage, since last event:
Lowest free space in bytes: 71894102016
Highest free space in bytes: 74981167104
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 26 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 188 | hv-cinder-80951 | S-1-5-18 | 9/27/2021 3:08:25 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 25 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 228 | hv-cinder-80951 | S-1-5-18 | 9/27/2021 3:08:19 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 2230226944
Highest free space in bytes: 2243223552
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 24 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 468 | WIN-5T344G8GM1H | S-1-5-18 | 9/27/2021 3:06:47 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000}
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 23 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 188 | WIN-5T344G8GM1H | S-1-5-18 | 9/27/2021 3:06:41 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 29832175616
Highest free space in bytes: 29835325440
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 22 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 1988 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 21 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:28 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 29901320192
Highest free space in bytes: 29926395904
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 20 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 2020 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 19 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 184 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:12 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 29918121984
Highest free space in bytes: 29918121984
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 18 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 168 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:37 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 17 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 192 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:31 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 28502818816
Highest free space in bytes: 29979299840
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 16 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 124 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 15 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 184 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:22:58 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 28196282368
Highest free space in bytes: 28346654720
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 14 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 312 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:52 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 13 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 184 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:47 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 28216385536
Highest free space in bytes: 28366708736
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 12 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 124 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:04 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 11 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 184 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:49:59 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 27284545536
Highest free space in bytes: 27288723456
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 10 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 192 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:59 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 9 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 192 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 10:23:53 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 24009318400
Highest free space in bytes: 24158986240
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 8 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 376 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:26 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 7 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 184 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:21 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 26337353728
Highest free space in bytes: 26549157888
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 6 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 120 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:12 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 5 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 192 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:06 PM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 32134189056
Highest free space in bytes: 32134750208
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 4 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 200 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 9:01:54 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: C:
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 3 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 176 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 9:01:49 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Summary of disk space usage, since last event:
Lowest free space in bytes: 32485502976
Highest free space in bytes: 33967284224
Page file size in bytes: 0
Volume guid: {BE07386B-0000-0000-0000-100000000000}
Volume name: C:
Is boot volume: true
| 142 | 0 | | 4 | 0 | 0 | 4611686018429485056 | 2 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 336 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/17/2018 3:00:55 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The NTFS volume has been successfully mounted.
Volume GUID: {BE07386B-0000-0000-0000-100000000000}
Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000}
Volume Label: OS
Device Name: \Device\HarddiskVolume1
| 4 | 0 | | 4 | 6 | 0 | 4611686018427387936 | 1 | Microsoft-Windows-Ntfs | 3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482 | Microsoft-Windows-Ntfs/Operational | 4 | 200 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/17/2018 3:00:49 AM | | | microsoft-windows-ntfs/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |