Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The DeviceInstall service has started.	8001	0		4	0	0	576460752303423490	6	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	908	556	n-h2-764625-2	S-1-5-18	11/30/2020 2:57:57 PM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The DeviceInstall service has started.	8001	0		4	0	0	576460752303423490	5	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	916	524	WIN-5T344G8GM1H	S-1-5-18	11/30/2020 2:56:33 PM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The DeviceInstall service is stopping (idle).	8002	0		4	0	0	576460752303423490	4	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	764	940	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:25 AM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The DeviceInstall service has started.	8001	0		4	0	0	576460752303423490	3	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	764	920	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:54 AM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The DeviceInstall service has started.	8001	0		4	0	0	576460752303423490	2	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	732	912	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The DeviceInstall service has started.	8001	0		4	0	0	576460752303423490	1	Microsoft-Windows-UserPnp	96f4a050-7e31-453c-88be-9634f4e02139	Microsoft-Windows-UserPnp/DeviceInstall	760	908	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-userpnp/deviceinstall	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]