Message	Id	Version	Level	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	KeywordsDisplayNames	Properties
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	565	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	564	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	563	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\HV-NEUTRON-8374$ in 0 seconds.	8000	1	4	2	4611686018427387904	562	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed Registry Extension Processing in 31 milliseconds.	5016	0	4	2	4611686018427387904	561	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	560	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	559	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	558	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	557	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting Registry Extension Processing. List of applicable Group Policy objects: (Changes were detected.) Local Group Policy	4016	0	4	1	4611686018427387904	556	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	555	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	554	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	553	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	552	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	551	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	550	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	549	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	548	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	547	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	546	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	545	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	544	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\HV-NEUTRON-8374$. Activity id: {502A31E4-B54A-4FDF-B154-CAD21858912C}	4000	1	4	1	4611686018427387904	543	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM	502a31e4-b54a-4fdf-b154-cad21858912c	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	542	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	4028	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	541	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	560	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:22 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 91296777-ca55-4083-a4ed-7432d31cc538	5321	0	4	0	4611686018427387904	540	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	1968	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:10 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	539	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	1968	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:10 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	538	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	1968	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:10 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	537	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	1968	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:10 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	536	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	1968	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:09 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	535	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	2008	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:09 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	534	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	596	2008	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:09 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	533	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	968	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:43:41 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	532	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	520	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:43:41 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: a43e7056-5378-402c-af8a-df9d78aa3d2b	5321	0	4	0	4611686018427387904	531	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	508	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:44 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	530	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	508	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:44 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	529	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	508	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:44 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	528	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	508	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:44 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	527	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	508	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:43 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	526	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	1472	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:43 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	525	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	524	1472	WIN-5T344G8GM1H	S-1-5-18	5/2/2022 10:42:43 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	524	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1440	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:13 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	523	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	980	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:13 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	522	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	672	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	521	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	3432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	520	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	3048	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:33 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	519	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	3048	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:33 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	518	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	517	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	516	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	515	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	514	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	513	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	512	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	511	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	510	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	509	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	508	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	507	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	506	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	505	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {523F618F-A541-4753-A681-3C0B79DB800A}	4001	1	4	1	4611686018427387904	504	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	523f618f-a541-4753-a681-3c0b79db800a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	503	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	502	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	501	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	500	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	499	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2072	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8004	1	4	2	4611686018427387904	498	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed Registry Extension Processing in 15 milliseconds.	5016	0	4	2	4611686018427387904	497	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting Registry Extension Processing. List of applicable Group Policy objects: (Changes were detected.) Local Group Policy	4016	0	4	1	4611686018427387904	496	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	495	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	494	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	493	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	492	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	491	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	490	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	489	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	488	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	487	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Background.	5340	0	4	0	4611686018427387904	486	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$. Activity id: {9663586B-26CE-4E7F-A115-7420EF71DDF6}	4004	1	4	1	4611686018427387904	485	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2552	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	9663586b-26ce-4e7f-a115-7420ef71ddf6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	484	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	483	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	482	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	481	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	480	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	479	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	478	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	477	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	476	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	475	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	474	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	473	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {E1363503-0E2F-45F8-B60E-F5C745BC2310}	4000	1	4	1	4611686018427387904	472	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM	e1363503-0e2f-45f8-b60e-f5c745bc2310	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	471	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	2472	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	470	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1376	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	469	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1376	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	468	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1376	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 17681e6a-4ec2-473c-afdb-140f3267c9cb	5321	0	4	0	4611686018427387904	467	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	466	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	465	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	464	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	463	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	462	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	461	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	976	1240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:29 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	460	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	459	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	960	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	458	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	457	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2760	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	456	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:19 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	455	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2776	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:19 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	454	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	453	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	452	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	451	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	450	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	449	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	448	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	447	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	446	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	445	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	444	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	443	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	442	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	441	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {19830159-0802-4690-81DF-314FC75BBEC1}	4001	1	4	1	4611686018427387904	440	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	19830159-0802-4690-81df-314fc75bbec1	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	439	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	438	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	372	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	437	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	436	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	435	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8004	1	4	2	4611686018427387904	434	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed Registry Extension Processing in 32 milliseconds.	5016	0	4	2	4611686018427387904	433	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting Registry Extension Processing. List of applicable Group Policy objects: (Changes were detected.) Local Group Policy	4016	0	4	1	4611686018427387904	432	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	431	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	430	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	429	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	428	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	427	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	426	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	425	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	424	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	423	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Background.	5340	0	4	0	4611686018427387904	422	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$. Activity id: {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}	4004	1	4	1	4611686018427387904	421	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	96fb381f-0cd5-4b08-b375-7d41e6d4bd5a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	420	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	419	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	418	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	417	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed Registry Extension Processing in 16 milliseconds.	5016	0	4	2	4611686018427387904	416	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	415	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	414	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	413	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting Registry Extension Processing. List of applicable Group Policy objects: (Changes were detected.) Local Group Policy	4016	0	4	1	4611686018427387904	412	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	411	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	410	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	409	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	408	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	407	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	406	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	405	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	404	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	403	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	402	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	401	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	400	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	399	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {FD8B735D-48A5-4AFF-82A0-4530749B9C93}	4000	1	4	1	4611686018427387904	398	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM	fd8b735d-48a5-4aff-82a0-4530749b9c93	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	397	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	396	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2624	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:17 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 2aee4e0b-fb00-4527-adc4-e481e4d19dcd	5321	0	4	0	4611686018427387904	395	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	394	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	393	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	392	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	391	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	432	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	390	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1252	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	389	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1252	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	388	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	3324	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:59 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	387	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	972	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:59 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 3bfff0c0-0165-424d-b905-a307b3220abe	5321	0	4	0	4611686018427387904	386	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	320	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	385	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	320	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	384	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	320	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	383	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	320	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	382	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	320	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	381	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	1240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	380	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	968	1240	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	379	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	3144	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:19 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	378	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	960	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:19 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	377	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1996	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	376	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:18 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	375	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2512	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:05 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	374	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2512	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:05 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	373	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	372	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	371	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	370	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	369	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	368	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	367	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	366	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	365	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	364	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	363	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	362	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	361	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	360	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {916D7BC6-7539-48F2-9F9E-92FDF76145FA}	4001	1	4	1	4611686018427387904	359	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	916d7bc6-7539-48f2-9f9e-92fdf76145fa	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	358	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	357	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2116	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	356	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	355	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	354	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2780	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	353	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	352	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	351	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	350	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	349	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	348	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	347	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	346	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	345	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	344	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	343	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	342	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	341	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	340	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	339	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {FB64062E-023F-45C2-95F3-82A8FD38A036}	4000	1	4	1	4611686018427387904	338	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM	fb64062e-023f-45c2-95f3-82a8fd38a036	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	337	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	336	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	335	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	2964	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	334	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 55f227a2-e54b-46f6-a36f-59838b5d3374	5321	0	4	0	4611686018427387904	333	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	332	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	331	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	330	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	329	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	724	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	328	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	327	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	956	1260	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	326	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	3520	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	325	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	324	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2516	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	323	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2444	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	322	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2044	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	321	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2044	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	320	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	319	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	318	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	317	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	316	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	315	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	314	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	313	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	312	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	311	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	310	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	309	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	308	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	307	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {16838B39-BD55-4D5F-A3E3-5D47A754DEB8}	4001	1	4	1	4611686018427387904	306	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	16838b39-bd55-4d5f-a3e3-5d47a754deb8	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	305	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	304	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	303	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	302	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	301	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	2504	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	300	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	299	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	298	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	297	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	296	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	295	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	294	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	293	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	292	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	291	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	290	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	289	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {EF9DC327-237A-498F-A234-5DD260AC2188}	4000	1	4	1	4611686018427387904	288	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	ef9dc327-237a-498f-a234-5dd260ac2188	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	287	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1420	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	286	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1420	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	285	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	284	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1420	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 1bab69f4-e4b0-4881-969a-4be66736ab81	5321	0	4	0	4611686018427387904	283	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	282	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	281	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	280	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	279	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1284	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	278	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1232	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	277	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1180	1232	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	276	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	3720	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:39 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	275	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:39 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	274	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:39 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	273	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2652	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:39 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	272	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1484	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:56 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	271	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1484	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:56 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	270	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	269	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	268	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	267	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	266	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	265	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	264	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	263	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	262	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	261	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	260	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	259	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	258	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	257	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {45025C4D-6F9D-4B05-92B5-93A82391A3DE}	4001	1	4	1	4611686018427387904	256	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	45025c4d-6f9d-4b05-92b5-93a82391a3de	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	255	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	254	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2816	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	253	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	252	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	251	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	250	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	249	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	248	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	247	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	246	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	245	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	244	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	243	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	242	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	241	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	240	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	239	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	238	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	237	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {A33A2B8C-390A-413D-8B21-12F16046F44F}	4000	1	4	1	4611686018427387904	236	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM	a33a2b8c-390a-413d-8b21-12f16046f44f	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	235	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	234	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	233	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	232	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2128	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	231	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:54 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: c59c478f-2ba4-4b8b-9216-af0e61f55471	5321	0	4	0	4611686018427387904	230	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	229	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	228	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	227	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	226	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1412	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	225	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1288	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	224	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1192	1288	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	223	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	772	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:57 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	222	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:57 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	221	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:56 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	220	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:56 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	219	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1564	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	218	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1564	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	217	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	216	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	215	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	214	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	213	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	212	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	211	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	210	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	209	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	208	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	207	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	206	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	205	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	204	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {65CB5132-E893-416B-A63D-2BA652D6D6C6}	4001	1	4	1	4611686018427387904	203	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	65cb5132-e893-416b-a63d-2ba652d6d6c6	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	202	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	201	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	3028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	200	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	199	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	198	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2404	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	197	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	196	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	195	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	194	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	193	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	192	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	191	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	190	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	189	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	188	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	187	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	186	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	185	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	184	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {ED5A8EC3-2E31-4880-B3CC-3D038F81C4A4}	4000	1	4	1	4611686018427387904	183	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	182	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2824	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	181	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	2316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 7ec6f95f-ca51-46fd-b628-91606dc57360	5321	0	4	0	4611686018427387904	180	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	88	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	179	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	88	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	178	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	88	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	177	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	88	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	176	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	88	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	175	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	174	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	964	1176	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	173	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1664	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	172	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1180	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	171	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	3168	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	170	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1724	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	169	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2384	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	168	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2384	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	167	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	166	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	165	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	164	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	163	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	162	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	161	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	160	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	159	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	158	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	157	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	156	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	155	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	154	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {F99EA46F-75FC-4CE4-8726-97FC03D1B568}	4001	1	4	1	4611686018427387904	153	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	f99ea46f-75fc-4ce4-8726-97fc03d1b568	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	152	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	151	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1692	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	150	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	149	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	148	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2580	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	147	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	146	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	145	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	144	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	143	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	142	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	141	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	140	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	139	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	138	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	137	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	136	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	135	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	134	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	133	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {FA8F8E72-590E-4AE5-9C6C-7D5C9F473623}	4000	1	4	1	4611686018427387904	132	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM	fa8f8e72-590e-4ae5-9c6c-7d5c9f473623	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	131	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	130	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	129	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2728	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	128	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	2640	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:01 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 3b55a67b-bb51-4c33-a51f-c935146e1612	5321	0	4	0	4611686018427387904	127	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1392	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	126	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1392	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	125	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1392	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	124	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1392	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	123	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1392	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	122	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1316	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	121	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1176	1316	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	120	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3660	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	119	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1156	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	118	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	5108	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	117	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	5108	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:38 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	116	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:07 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	115	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:07 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	114	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	113	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	112	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	111	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	110	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	109	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	108	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	107	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	106	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	105	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	104	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	103	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	102	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	101	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {B40A7D2E-EE0B-4AFD-8EF4-53A4B91BD98D}	4001	1	4	1	4611686018427387904	100	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	99	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	98	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2784	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	97	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	96	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	95	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2600	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	94	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	93	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	92	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	91	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	90	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	89	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	88	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	87	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	86	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	85	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	84	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	83	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	82	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	81	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	80	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	79	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	78	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {280DA8C2-EAC4-4740-9F29-D442B4641CDA}	4000	1	4	1	4611686018427387904	77	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM	280da8c2-eac4-4740-9f29-d442b4641cda	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	76	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	3056	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	75	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	2400	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:05 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: ad8eaacf-9ac8-4b59-9d35-13bd21983404	5321	0	4	0	4611686018427387904	74	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1364	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	73	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1364	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	72	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1364	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	71	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1364	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	70	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1364	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	69	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1276	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	68	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	1152	1276	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	67	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	6040	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:50 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	66	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:50 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logoff from Winlogon for session 1.	5324	0	4	0	4611686018427387904	65	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:49 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification EndShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	64	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	932	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:49 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon Start Shell handling completed.	6339	0	4	0	4611686018427387904	63	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification StartShell from Winlogon for session 1.	5324	0	4	0	4611686018427387904	62	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	61	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	60	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	59	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds.	8001	1	4	2	4611686018427387904	58	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed Registry Extension Processing in 16 milliseconds.	5016	0	4	2	4611686018427387904	57	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	56	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	55	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	54	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting Registry Extension Processing. List of applicable Group Policy objects: (Changes were detected.) Local Group Policy	4016	0	4	1	4611686018427387904	53	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	52	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	51	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	50	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : None	5313	0	4	0	4611686018427387904	49	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: Local Group Policy	5312	0	4	0	4611686018427387904	48	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	47	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	46	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	45	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	44	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	43	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator. Activity id: {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}	4001	1	4	1	4611686018427387904	42	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	822ad6c6-a4a6-4a78-b264-65e46a20efbb	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	41	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	40	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	39	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	38	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification Logon from Winlogon for session 1.	5324	0	4	0	4611686018427387904	37	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session completed successfully.	5117	0	4	0	4611686018427387904	36	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	35	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	2872	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	34	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	2872	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds.	8000	1	4	2	4611686018427387904	33	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Finished checking for non-system extensions.	5320	0	4	0	4611686018427387904	32	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Service configuration update to standalone is not required and will be skipped.	5320	0	4	0	4611686018427387904	31	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Checking for Group Policy client extensions that are not part of the system.	5320	0	4	0	4611686018427387904	30	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The following Group Policy objects were not applicable because they were filtered out : Local Group Policy Not Applied (Empty)	5313	0	4	0	4611686018427387904	29	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
List of applicable Group Policy objects: None	5312	0	4	0	4611686018427387904	28	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy successfully got applicable GPOs from the domain controller.	5126	0	4	0	4611686018427387904	27	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed downloading policies.	5257	0	4	0	4611686018427387904	26	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy receiving applicable GPOs from the domain controller.	4126	0	4	0	4611686018427387904	25	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The loopback policy processing mode is "No loopback mode".	5311	0	4	0	4611686018427387904	24	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	23	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	2872	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy processing mode is Foreground synchronous.	5340	0	4	0	4611686018427387904	22	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$. Activity id: {227CEB83-33CD-4922-AED0-D222BC464B1A}	4000	1	4	1	4611686018427387904	21	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM	227ceb83-33cd-4922-aed0-d222bc464b1a	microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group policy session returned to winlogon.	5351	0	4	0	4611686018427387904	20	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Winlogon status reporting has completed.	6338	0	4	0	4611686018427387904	19	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Session started.	4117	0	4	0	4611686018427387904	18	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	3492	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received the notification CreateSession from Winlogon for session 1.	5324	0	4	0	4611686018427387904	17	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1948	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:09 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: 3dbc3a1f-1e0f-497f-bf39-81527fa03b67	5321	0	4	0	4611686018427387904	16	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:59 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	15	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:59 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	14	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:59 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	13	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:59 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	12	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:58 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	11	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1732	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:58 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	10	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	924	1732	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:58 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service stopped.	5115	0	4	0	4611686018427387904	9	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	2760	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy received Preshutdown notification from Service Control Manager.	5325	0	4	0	4611686018427387904	8	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	920	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A previous instance of the Group Policy Client Service was detected. Parameter: e9a66211-b3b2-4290-a071-282831c76b8b	5321	0	4	0	4611686018427387904	7	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	944	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing service instance state to detect previous instances of the service.	5320	0	4	0	4611686018427387904	6	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	944	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Initializing and reading current service configuration for the Group Policy Client service.	5320	0	4	0	4611686018427387904	5	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	944	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Group Policy Client service is currently configured as a shared service.	5320	0	4	0	4611686018427387904	4	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	944	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully completed the Group Policy Service initialization phase.	5116	0	4	0	4611686018427387904	3	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	944	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Group Policy Service started.	4115	0	4	0	4611686018427387904	2	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	1452	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Started the Group Policy service initialization phase.	4116	0	4	0	4611686018427387904	1	Microsoft-Windows-GroupPolicy	aea1b4fa-97d1-45f2-a64c-4d69fffd92c9	Microsoft-Windows-GroupPolicy/Operational	916	1452	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:14 PM		microsoft-windows-grouppolicy/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]