Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	126	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	940	360	n-h2-766043-1.cbci-766043-1.local	S-1-5-18	12/8/2020 5:47:49 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	125	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	2292	n-h2-766043-1	S-1-5-18	12/8/2020 5:47:27 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	124	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:32 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	123	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:28 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	122	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:27 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	121	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:27 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	120	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	119	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	118	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	117	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	116	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	115	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	944	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	114	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	908	1008	n-h2-766043-1	S-1-5-18	12/8/2020 4:55:23 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	113	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	944	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:55:03 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	112	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:55:03 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	111	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:55:02 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	110	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:43 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	109	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:39 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	108	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:39 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	107	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:39 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	106	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:39 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	105	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	104	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	103	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	102	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	101	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	100	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1020	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	99	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	912	1012	WIN-5T344G8GM1H	S-1-5-18	12/8/2020 4:53:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	98	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	800	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:13 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	97	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	4680	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	96	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	800	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	95	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	800	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	94	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	800	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	93	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	944	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:12 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	92	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	944	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:33 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	91	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	968	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	90	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	944	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:31 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	89	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	944	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:31 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	88	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:30 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	87	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	86	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	788	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:40:27 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	85	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	916	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:19 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	84	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	1016	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	83	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	1016	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	82	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	1016	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	81	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	756	860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:15 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	80	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	744	860	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:54 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	79	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	744	852	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:40 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	78	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	3256	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:19 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	77	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	908	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:18 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	76	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	936	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:05 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	75	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	936	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	74	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	936	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	73	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	936	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:04 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	72	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:00 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	71	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	608	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	70	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	848	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:48 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	69	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	848	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	68	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	956	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:50 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	67	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	956	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	66	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	956	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	65	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	736	840	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:49 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	64	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	912	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:39 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	63	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:38 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	62	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	864	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:56 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	61	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	60	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	59	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	868	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:55 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	58	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	836	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:03 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	57	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	2088	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:56 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	56	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	2740	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:45:55 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	55	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	796	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	54	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	940	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:01 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	53	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	940	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	52	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	940	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:24:00 AM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	51	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	764	872	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:54 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	50	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	3424	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:38 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	49	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	2756	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:44:37 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	48	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	928	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	47	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	892	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	46	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	892	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	45	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	892	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:07:02 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	44	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	864	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:24 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	43	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	732	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:38 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	42	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	932	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:02:36 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	41	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	924	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:07 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	40	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	900	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	39	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	900	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	38	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	900	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:43:06 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	37	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	768	872	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:10 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logoff succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1	23	0		4	0	0	1152921504606846976	36	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	648	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:49 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	35	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	4532	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:35:48 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Shell start notification received: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	22	0		4	0	0	1152921504606846976	34	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	764	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services: Session logon succeeded: User: WIN-5T344G8GM1H\Administrator Session ID: 1 Source Network Address: LOCAL	21	0		4	0	0	1152921504606846976	33	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	2844	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:11 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
End session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	42	0		4	0	0	1152921504606846976	32	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	1440	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:10 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Begin session arbitration: User: WIN-5T344G8GM1H\Administrator Session ID: 1	41	0		4	0	0	1152921504606846976	31	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	1440	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:10 PM	61a55000-55e5-1017-0000-000000000000		microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	30	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:02:04 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	29	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:01:59 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	28	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	27	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	26	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	25	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	24	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	23	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	22	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	21	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	20	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	840	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	19	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	732	832	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:51 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Local multi-user session manager received system shutdown message	54	0		4	0	0	1152921504606846976	18	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	2168	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	17	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	16	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	15	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 9:01:40 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	14	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/16/2018 5:01:34 PM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	13	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:14 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	12	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:10 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	11	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:09 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	10	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:09 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	9	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:09 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	8	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:09 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	7	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	6	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	5	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	4	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	3	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Remote Desktop Services is not accepting logons because setup is running.	34	0		4	0	0	1152921504606846976	2	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	792	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Plugin RDSAppXPlugin has been successfully initialized	32	0		4	0	0	1152921504606846976	1	Microsoft-Windows-TerminalServices-LocalSessionManager	5d896912-022d-40aa-a3a8-4fa5515c76d7	Microsoft-Windows-TerminalServices-LocalSessionManager/Operational	760	860	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:01:05 AM			microsoft-windows-terminalservices-localsessionmanager/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]