Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	113	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 2:13:35 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	112	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:43:35 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A6FCBE20-DF37-461C-BEBC-E2126111C5F4}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	111	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM	a6fcbe20-df37-461c-bebc-e2126111c5f4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{A6FCBE20-DF37-461C-BEBC-E2126111C5F4}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	110	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM	a6fcbe20-df37-461c-bebc-e2126111c5f4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{A6FCBE20-DF37-461C-BEBC-E2126111C5F4}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1		4	200	1	-9223372036854775808	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM	a6fcbe20-df37-461c-bebc-e2126111c5f4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A6FCBE20-DF37-461C-BEBC-E2126111C5F4}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM	a6fcbe20-df37-461c-bebc-e2126111c5f4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 968.	129	0		4	129	0	-9223372036854775808	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{A6FCBE20-DF37-461C-BEBC-E2126111C5F4}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0		4	118	0	-9223372036854775808	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:23:05 AM	a6fcbe20-df37-461c-bebc-e2126111c5f4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:13:35 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0		4	140	0	-9223372036854775808	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 1:01:50 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{59DD3333-793E-44CD-800D-BFFCA59119C1}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2960	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:53:04 AM	59dd3333-793e-44cd-800d-bffca59119c1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{59DD3333-793E-44CD-800D-BFFCA59119C1}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2960	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:53:04 AM	59dd3333-793e-44cd-800d-bffca59119c1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{59DD3333-793E-44CD-800D-BFFCA59119C1}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1		4	200	1	-9223372036854775808	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2960	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:53:04 AM	59dd3333-793e-44cd-800d-bffca59119c1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{59DD3333-793E-44CD-800D-BFFCA59119C1}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2960	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:53:04 AM	59dd3333-793e-44cd-800d-bffca59119c1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 4556.	129	0		4	129	0	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2960	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:53:04 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0		4	142	0	-9223372036854775808	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0		4	140	0	-9223372036854775808	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{FFBBFD38-D890-46EC-ADFB-09C7642B8959}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM	ffbbfd38-d890-46ec-adfb-09c7642b8959		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{FFBBFD38-D890-46EC-ADFB-09C7642B8959}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM	ffbbfd38-d890-46ec-adfb-09c7642b8959		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{FFBBFD38-D890-46EC-ADFB-09C7642B8959}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM	ffbbfd38-d890-46ec-adfb-09c7642b8959		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{FFBBFD38-D890-46EC-ADFB-09C7642B8959}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM	ffbbfd38-d890-46ec-adfb-09c7642b8959		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3140.	129	0		4	129	0	-9223372036854775808	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{FFBBFD38-D890-46EC-ADFB-09C7642B8959}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0		4	118	0	-9223372036854775808	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:05 AM	ffbbfd38-d890-46ec-adfb-09c7642b8959		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{1FCA0D44-89A8-418F-A0D6-268F3234BBDD}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM	1fca0d44-89a8-418f-a0d6-268f3234bbdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{1FCA0D44-89A8-418F-A0D6-268F3234BBDD}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM	1fca0d44-89a8-418f-a0d6-268f3234bbdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0		4	140	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2688	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{1FCA0D44-89A8-418F-A0D6-268F3234BBDD}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1		4	200	1	-9223372036854775808	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM	1fca0d44-89a8-418f-a0d6-268f3234bbdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{1FCA0D44-89A8-418F-A0D6-268F3234BBDD}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM	1fca0d44-89a8-418f-a0d6-268f3234bbdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 4024.	129	0		4	129	0	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{1FCA0D44-89A8-418F-A0D6-268F3234BBDD}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:46:04 AM	1fca0d44-89a8-418f-a0d6-268f3234bbdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2688	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:45:36 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D0AA5F07-93E6-429E-8762-BA80FA061305}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2828	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:54 AM	d0aa5f07-93e6-429e-8762-ba80fa061305		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{D0AA5F07-93E6-429E-8762-BA80FA061305}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2828	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:54 AM	d0aa5f07-93e6-429e-8762-ba80fa061305		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CE22AE3B-4D74-4ACE-A445-D7FF4A30D264}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2828	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM	ce22ae3b-4d74-4ace-a445-d7ff4a30d264		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{CE22AE3B-4D74-4ACE-A445-D7FF4A30D264}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2828	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM	ce22ae3b-4d74-4ace-a445-d7ff4a30d264		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{CE22AE3B-4D74-4ACE-A445-D7FF4A30D264}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1		4	200	1	-9223372036854775808	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM	ce22ae3b-4d74-4ace-a445-d7ff4a30d264		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CE22AE3B-4D74-4ACE-A445-D7FF4A30D264}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM	ce22ae3b-4d74-4ace-a445-d7ff4a30d264		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 4524.	129	0		4	129	0	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{CE22AE3B-4D74-4ACE-A445-D7FF4A30D264}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0		4	118	0	-9223372036854775808	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:44:05 AM	ce22ae3b-4d74-4ace-a445-d7ff4a30d264		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-766380-21\N-H1-766380-21$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:42 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0764FF4D-94EF-4923-B786-86923F63A116}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	0764ff4d-94ef-4923-b786-86923f63a116		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{0764FF4D-94EF-4923-B786-86923F63A116}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	0764ff4d-94ef-4923-b786-86923f63a116		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{0764FF4D-94EF-4923-B786-86923F63A116}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	0764ff4d-94ef-4923-b786-86923f63a116		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0764FF4D-94EF-4923-B786-86923F63A116}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	0764ff4d-94ef-4923-b786-86923f63a116		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4352.	129	0		4	129	0	-9223372036854775808	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{389CFCC9-FADB-48AF-84AE-1B3CCD92D678}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	389cfcc9-fadb-48af-84ae-1b3ccd92d678		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{389CFCC9-FADB-48AF-84AE-1B3CCD92D678}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	389cfcc9-fadb-48af-84ae-1b3ccd92d678		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{06ED5FD7-B352-4EE8-8A23-59D1A0867389}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	06ed5fd7-b352-4ee8-8a23-59d1a0867389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{06ED5FD7-B352-4EE8-8A23-59D1A0867389}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	06ed5fd7-b352-4ee8-8a23-59d1a0867389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{06ED5FD7-B352-4EE8-8A23-59D1A0867389}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	06ed5fd7-b352-4ee8-8a23-59d1a0867389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{06ED5FD7-B352-4EE8-8A23-59D1A0867389}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	06ed5fd7-b352-4ee8-8a23-59d1a0867389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{389CFCC9-FADB-48AF-84AE-1B3CCD92D678}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	389cfcc9-fadb-48af-84ae-1b3ccd92d678		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{389CFCC9-FADB-48AF-84AE-1B3CCD92D678}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM	389cfcc9-fadb-48af-84ae-1b3ccd92d678		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 4380.	129	0		4	129	0	-9223372036854775808	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1696	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:35 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{61257EE5-48BE-43A6-8BAB-ACEBD3C3712D}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	61257ee5-48be-43a6-8bab-acebd3c3712d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{61257EE5-48BE-43A6-8BAB-ACEBD3C3712D}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	61257ee5-48be-43a6-8bab-acebd3c3712d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E6BEFBD3-2C29-4EF4-9EA8-25B1E3A10ED6}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	e6befbd3-2c29-4ef4-9ea8-25b1e3a10ed6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{E6BEFBD3-2C29-4EF4-9EA8-25B1E3A10ED6}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	e6befbd3-2c29-4ef4-9ea8-25b1e3a10ed6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{DD22A6F7-8E3A-401C-83C6-845EE90AB2AC}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	dd22a6f7-8e3a-401c-83c6-845ee90ab2ac		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{DD22A6F7-8E3A-401C-83C6-845EE90AB2AC}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	dd22a6f7-8e3a-401c-83c6-845ee90ab2ac		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{53766F65-77A2-4996-AA49-F055F7E93D71}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	53766f65-77a2-4996-aa49-f055f7e93d71		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{53766F65-77A2-4996-AA49-F055F7E93D71}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	53766f65-77a2-4996-aa49-f055f7e93d71		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{53766F65-77A2-4996-AA49-F055F7E93D71}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2456	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	53766f65-77a2-4996-aa49-f055f7e93d71		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{53766F65-77A2-4996-AA49-F055F7E93D71}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2456	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	53766f65-77a2-4996-aa49-f055f7e93d71		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{1E278395-C412-40A1-982A-8BEDF48EC2B1}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	1e278395-c412-40a1-982a-8bedf48ec2b1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{1E278395-C412-40A1-982A-8BEDF48EC2B1}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	1e278395-c412-40a1-982a-8bedf48ec2b1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{1E278395-C412-40A1-982A-8BEDF48EC2B1}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3816	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	1e278395-c412-40a1-982a-8bedf48ec2b1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{1E278395-C412-40A1-982A-8BEDF48EC2B1}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3816	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	1e278395-c412-40a1-982a-8bedf48ec2b1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5BC1DD4D-1C63-49E4-8779-FA8ED0A9367B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	5bc1dd4d-1c63-49e4-8779-fa8ed0a9367b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{5BC1DD4D-1C63-49E4-8779-FA8ED0A9367B}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	5bc1dd4d-1c63-49e4-8779-fa8ed0a9367b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{5BC1DD4D-1C63-49E4-8779-FA8ED0A9367B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3832	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	5bc1dd4d-1c63-49e4-8779-fa8ed0a9367b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5BC1DD4D-1C63-49E4-8779-FA8ED0A9367B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3832	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	5bc1dd4d-1c63-49e4-8779-fa8ed0a9367b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	c0fdc34a-5e1e-4570-bee6-0e8114c0f011		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	c0fdc34a-5e1e-4570-bee6-0e8114c0f011		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{40B12F2D-C4BD-408C-86B8-7EA13331F79D}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	40b12f2d-c4bd-408c-86b8-7ea13331f79d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{40B12F2D-C4BD-408C-86B8-7EA13331F79D}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2784	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	40b12f2d-c4bd-408c-86b8-7ea13331f79d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{40B12F2D-C4BD-408C-86B8-7EA13331F79D}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	40b12f2d-c4bd-408c-86b8-7ea13331f79d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{40B12F2D-C4BD-408C-86B8-7EA13331F79D}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	40b12f2d-c4bd-408c-86b8-7ea13331f79d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{DD22A6F7-8E3A-401C-83C6-845EE90AB2AC}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	dd22a6f7-8e3a-401c-83c6-845ee90ab2ac		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{DD22A6F7-8E3A-401C-83C6-845EE90AB2AC}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	dd22a6f7-8e3a-401c-83c6-845ee90ab2ac		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{53766F65-77A2-4996-AA49-F055F7E93D71}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" completes.	324	0		3	324	0	-9223372036854775808	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:26 AM	53766f65-77a2-4996-aa49-f055f7e93d71		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A435B100-959A-4099-A7B2-9918A681A389}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	a435b100-959a-4099-a7b2-9918a681a389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{A435B100-959A-4099-A7B2-9918A681A389}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	a435b100-959a-4099-a7b2-9918a681a389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{A435B100-959A-4099-A7B2-9918A681A389}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3816	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	a435b100-959a-4099-a7b2-9918a681a389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A435B100-959A-4099-A7B2-9918A681A389}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	3816	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	a435b100-959a-4099-a7b2-9918a681a389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6607E472-AA75-4EEC-8795-7D3FF7D12DB0}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	6607e472-aa75-4eec-8795-7d3ff7d12db0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{6607E472-AA75-4EEC-8795-7D3FF7D12DB0}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:22 AM	6607e472-aa75-4eec-8795-7d3ff7d12db0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{61257EE5-48BE-43A6-8BAB-ACEBD3C3712D}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	61257ee5-48be-43a6-8bab-acebd3c3712d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{61257EE5-48BE-43A6-8BAB-ACEBD3C3712D}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	61257ee5-48be-43a6-8bab-acebd3c3712d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 4980.	129	0		4	129	0	-9223372036854775808	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{00000000-0000-0000-0000-000000000000}" instance of task "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" according to an event trigger.	108	0		4	108	0	-9223372036854775808	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on event	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{33B973D4-58A2-49CD-A41F-A0D120FED594}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	33b973d4-58a2-49cd-a41f-a0d120fed594		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{33B973D4-58A2-49CD-A41F-A0D120FED594}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	33b973d4-58a2-49cd-a41f-a0d120fed594		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{68D6CCB1-488D-4D48-9FF4-05652431717B}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	68d6ccb1-488d-4d48-9ff4-05652431717b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{68D6CCB1-488D-4D48-9FF4-05652431717B}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:21 AM	68d6ccb1-488d-4d48-9ff4-05652431717b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{E6BEFBD3-2C29-4EF4-9EA8-25B1E3A10ED6}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:15 AM	e6befbd3-2c29-4ef4-9ea8-25b1e3a10ed6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E6BEFBD3-2C29-4EF4-9EA8-25B1E3A10ED6}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:15 AM	e6befbd3-2c29-4ef4-9ea8-25b1e3a10ed6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{E6BEFBD3-2C29-4EF4-9EA8-25B1E3A10ED6}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0		4	118	0	-9223372036854775808	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:15 AM	e6befbd3-2c29-4ef4-9ea8-25b1e3a10ed6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{A435B100-959A-4099-A7B2-9918A681A389}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{6607E472-AA75-4EEC-8795-7D3FF7D12DB0}" completes.	324	0		3	324	0	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	a435b100-959a-4099-a7b2-9918a681a389		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{1E278395-C412-40A1-982A-8BEDF48EC2B1}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" completes.	324	0		3	324	0	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	1e278395-c412-40a1-982a-8bedf48ec2b1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{5BC1DD4D-1C63-49E4-8779-FA8ED0A9367B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" completes.	324	0		3	324	0	-9223372036854775808	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2564	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	5bc1dd4d-1c63-49e4-8779-fa8ed0a9367b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{68D6CCB1-488D-4D48-9FF4-05652431717B}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	68d6ccb1-488d-4d48-9ff4-05652431717b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{68D6CCB1-488D-4D48-9FF4-05652431717B}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	68d6ccb1-488d-4d48-9ff4-05652431717b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{6607E472-AA75-4EEC-8795-7D3FF7D12DB0}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	6607e472-aa75-4eec-8795-7d3ff7d12db0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6607E472-AA75-4EEC-8795-7D3FF7D12DB0}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2792	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	6607e472-aa75-4eec-8795-7d3ff7d12db0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{33B973D4-58A2-49CD-A41F-A0D120FED594}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	33b973d4-58a2-49cd-a41f-a0d120fed594		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{33B973D4-58A2-49CD-A41F-A0D120FED594}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1312	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:08 AM	33b973d4-58a2-49cd-a41f-a0d120fed594		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{D0AA5F07-93E6-429E-8762-BA80FA061305}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM	d0aa5f07-93e6-429e-8762-ba80fa061305		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D0AA5F07-93E6-429E-8762-BA80FA061305}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM	d0aa5f07-93e6-429e-8762-ba80fa061305		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 3104.	129	0		4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	1396	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2224	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM	c0fdc34a-5e1e-4570-bee6-0e8114c0f011		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{C0FDC34A-5E1E-4570-BEE6-0E8114C0F011}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2224	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM	c0fdc34a-5e1e-4570-bee6-0e8114c0f011		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3084.	129	0		4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1324	2224	n-h1-766380-21.cbci-766380-21.local	S-1-5-18	8/10/2021 12:43:05 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]