Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	36	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1512	2164	n-h2-765311-5.cbci-765311-5.local	S-1-5-18	12/9/2020 1:30:47 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	35	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	92	1244	n-h2-765311-5.cbci-765311-5.local	S-1-5-20	12/9/2020 1:30:47 AM	f462406c-6fdc-48c0-97ac-70390af90000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	34	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	92	1244	n-h2-765311-5.cbci-765311-5.local	S-1-5-20	12/9/2020 1:30:47 AM	f462406c-6fdc-48c0-97ac-70390af90000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	33	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	560	3424	n-h2-765311-5	S-1-5-18	12/9/2020 12:45:56 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	32	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1492	3136	n-h2-765311-5	S-1-5-20	12/9/2020 12:45:56 AM	f46291a1-56f9-4b1c-9fe9-fae3bc8d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	31	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1492	3136	n-h2-765311-5	S-1-5-20	12/9/2020 12:45:56 AM	f46291a1-56f9-4b1c-9fe9-fae3bc8d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.	1143	0		4	0	0	1152921504606846976	30	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	976	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	29	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	976	1908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	28	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	984	420	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:29 AM	f462a289-5ea2-4e24-8d1c-4f9d50380000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	27	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	984	420	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:29 AM	f462a289-5ea2-4e24-8d1c-4f9d50380000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	26	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	2008	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	25	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:15 AM	f462577a-4b56-4363-8375-9b7bca5a0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	24	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	800	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:15 AM	f462577a-4b56-4363-8375-9b7bca5a0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	23	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	968	1948	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	22	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	952	396	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:40 AM	f462bcc9-4a9a-4242-9ba3-88859f990000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	21	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	952	396	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:40 AM	f462bcc9-4a9a-4242-9ba3-88859f990000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	20	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	1896	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	19	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:00 AM	f4626442-17da-4103-8310-2fd3aafa0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	18	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:00 AM	f4626442-17da-4103-8310-2fd3aafa0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	17	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1180	1832	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:48 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	16	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	92	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:48 AM	f4628412-5c34-4b9c-a1b5-f3dc75f10000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	15	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	92	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:48 AM	f4628412-5c34-4b9c-a1b5-f3dc75f10000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	14	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1192	1804	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:02 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	13	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1012	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:02 AM	f462d7e1-d113-46f5-a693-6bd857000000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	12	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1012	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:02 AM	f462d7e1-d113-46f5-a693-6bd857000000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	11	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	964	1712	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:55 AM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	10	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	972	340	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:55 AM	f4624cae-69bd-4d38-876f-5a416b4d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	9	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	972	340	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:55 AM	f4624cae-69bd-4d38-876f-5a416b4d0000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	8	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1176	1800	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	7	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1020	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM	f4621545-cfc5-42fe-bf6f-6d3e31c20000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	6	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	940	1020	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM	f4621545-cfc5-42fe-bf6f-6d3e31c20000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	5	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	1152	1904	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:11 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener 31C5CE94259D4006A9E4 has started listening	258	0		4	0	0	1152921504606846976	4	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	88	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	f462c821-a45c-45f2-8bbb-cfbb56220000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	3	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	956	88	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	f462c821-a45c-45f2-8bbb-cfbb56220000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
RD Session Host Server role is not installed.	1136	0		4	0	0	1152921504606846976	2	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	924	2564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:04 PM			microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Listener RDP-Tcp has started listening	258	0		4	0	0	1152921504606846976	1	Microsoft-Windows-TerminalServices-RemoteConnectionManager	c76baa63-ae81-421c-b425-340b4b24157f	Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational	2980	3032	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:02:04 PM	f462ae1e-ecf4-4ef1-9123-eb41fc650000		microsoft-windows-terminalservices-remoteconnectionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]