Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	33	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	596	3532	hv-neutron-8374	S-1-5-18	5/2/2022 10:44:15 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	32	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	3160	3288	hv-neutron-8374	S-1-5-20	5/2/2022 10:44:15 AM	f4628995-4c5a-429c-9b31-1cf2494f0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	31	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	3160	3288	hv-neutron-8374	S-1-5-20	5/2/2022 10:44:15 AM	f4628995-4c5a-429c-9b31-1cf2494f0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.	1143	0		4	0	0	1152921504606846976	30	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	976	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	29	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	976	1908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	28	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	984	420	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:29 AM	f462a289-5ea2-4e24-8d1c-4f9d50380000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	27	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	984	420	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:29 AM	f462a289-5ea2-4e24-8d1c-4f9d50380000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	26	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	2008	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	25	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:15 AM	f462577a-4b56-4363-8375-9b7bca5a0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	24	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:15 AM	f462577a-4b56-4363-8375-9b7bca5a0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	23	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	1948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	22	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	952	396	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:40 AM	f462bcc9-4a9a-4242-9ba3-88859f990000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	21	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	952	396	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:40 AM	f462bcc9-4a9a-4242-9ba3-88859f990000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	20	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	1896	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	19	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:00 AM	f4626442-17da-4103-8310-2fd3aafa0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	18	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:00 AM	f4626442-17da-4103-8310-2fd3aafa0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	17	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	16	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	92	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:48 AM	f4628412-5c34-4b9c-a1b5-f3dc75f10000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	15	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	92	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:48 AM	f4628412-5c34-4b9c-a1b5-f3dc75f10000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	14	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1192	1804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	13	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1012	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:02 AM	f462d7e1-d113-46f5-a693-6bd857000000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	12	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1012	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:02 AM	f462d7e1-d113-46f5-a693-6bd857000000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	11	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	1712	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	10	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	972	340	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:55 AM	f4624cae-69bd-4d38-876f-5a416b4d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	9	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	972	340	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:55 AM	f4624cae-69bd-4d38-876f-5a416b4d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	8	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1176	1800	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	7	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1020	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM	f4621545-cfc5-42fe-bf6f-6d3e31c20000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	6	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1020	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM	f4621545-cfc5-42fe-bf6f-6d3e31c20000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	5	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1152	1904	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	4	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	88	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	f462c821-a45c-45f2-8bbb-cfbb56220000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	3	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	88	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	f462c821-a45c-45f2-8bbb-cfbb56220000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	2	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	924	2564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:04 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	1	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	2980	3032	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:04 PM	f462ae1e-ecf4-4ef1-9123-eb41fc650000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]